VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,607)

page 2288 of 2,331
  • CVE-2008-6127Feb 13, 2009
    Mozilo
    Mozilocms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) page and (2) query parameters to (a) index.php, (3) cat and (4) file parameters to (b) download.php, (5) gal parameter to…

  • CVE-2009-0575Feb 13, 2009
    Drupal
    Views Bulk Operations
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the theme_views_bulk_operations_confirmation function in views_bulk_operations.module in Views Bulk Operations 5.x before 5.x-1.3 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or…

  • CVE-2009-0548Feb 12, 2009
    Eset
    Remote Administrator
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Additional Report Settings interface in ESET Remote Administrator before 3.0.105 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party…

  • CVE-2009-0533Feb 11, 2009
    Scripts For Sites
    Ez Reminder
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in password.php in Scripts for Sites EZ Reminder allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the…

  • CVE-2009-0532Feb 11, 2009
    Scripts For Sites
    Ez Baby
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in password.php in Scripts For Sites (SFS) EZ Baby allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the…

  • CVE-2009-0525Feb 11, 2009
    Sajax
    Sajax
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the sajax_get_common_js function in php/Sajax.php in Sajax 0.12 allows remote attackers to inject arbitrary web script or HTML via the URL parameter, which is not properly handled when using browsers that do not URL-encode requests,…

  • CVE-2008-6113Feb 11, 2009
    Semanticscuttle
    Semanticscuttle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SemanticScuttle before 0.90 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the (1) username and (2) profile page.

  • CVE-2008-6108Feb 10, 2009
    Galatolo
    Galatolo Webmanager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in result.php in Galatolo WebManager (GWM) 1.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter.

  • CVE-2008-6105Feb 10, 2009
    IBM
    Workplace For Business Controls And Reporting
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from…

  • CVE-2009-0466Feb 10, 2009
    Vivvo
    Vivvo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Vivvo CMS before 4.1.1 allows remote attackers to inject arbitrary web script or HTML via a URI that triggers a 404 Page Not Found response.

  • CVE-2009-0417Feb 10, 2009
    Agavi
    Agavi
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web…

  • CVE-2009-0502Feb 10, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not…

  • CVE-2009-0500Feb 10, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in course/lib.php in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via crafted log table information that is not properly handled when it…

  • CVE-2009-0488Feb 9, 2009
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-0487Feb 9, 2009
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Mahara before 1.0.9 allows remote attackers to inject arbitrary web script or HTML via a crafted forum post.

  • CVE-2009-0481Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.

  • CVE-2008-6096Feb 9, 2009
    Juniper Networks
    Screenos
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10, 6.0r6, and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user name parameter to the (1) web interface login page or the (2) telnet login page.

  • CVE-2008-6095Feb 9, 2009
    Opennms
    Opennms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows remote attackers to inject arbitrary web script or HTML via the viewName parameter.

  • CVE-2009-0472Feb 6, 2009
    Rockwellautomation
    Controllogix 1756 Enbt\/a Ethernet\/ Ip Bridge
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-6062Feb 5, 2009
    Adobe Inc.
    Dreamweaver
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver, when the Insert Flash Video feature is used, allows remote attackers to inject arbitrary web script or HTML via an asfunction: URI in the skinName…