VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,541)

page 2325 of 2,428
  • CVE-2012-1060Feb 14, 2012
    Drupal
    revisioning
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in revisioning_theme.inc in the Taxonomy module in the Revisioning module 6.x-3.13 and other versions before 6.x-3.14 for Drupal allow remote authenticated users with certain privileges to inject arbitrary web script or HTML…

  • CVE-2012-1059Feb 14, 2012
    OsCommerce
    Online Merchant
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, as demonstrated using the "Front" field in…

  • CVE-2012-0340Feb 13, 2012
    Cisco Systems, Inc.
    Ironport Encryption Appliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the management interface on the Cisco IronPort Encryption Appliance with software before 6.5.3 allows remote attackers to inject arbitrary web script or HTML via the header parameter to the default URI under admin/, aka bug ID 72410.

  • CVE-2011-4341Feb 12, 2012
    Getsymphony
    Symphonycms
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1)…

  • CVE-2012-0834Feb 11, 2012
    Phpldapadmin Project
    Phpldapadmin
    risk 0.00cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.

  • CVE-2012-1046Feb 10, 2012
    IBM
    Cognos Tm1
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in TM1 Web in IBM Cognos TM1 9.5.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0696.

  • CVE-2011-4038Feb 10, 2012
    Invensys
    Wonderware Hmi Reports
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2012-1034Feb 8, 2012
    Episerver
    CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the admin interface in EPiServer CMS through 6R2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1004Feb 8, 2012
    Foswiki
    Foswiki
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl,…

  • CVE-2012-1020Feb 8, 2012
    NexorONE
    Online Banking
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the (1) visitor_language parameter to register.php or (2) message parameter.

  • CVE-2012-1019Feb 8, 2012
    Cryptpad
    XWiki Enterprise
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) XWiki.XWikiComments_comment parameter to xwiki/bin/commentadd/Main/WebHome, (2) XWiki.XWikiUsers_0_company parameter when editing…

  • CVE-2011-4511Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and…

  • CVE-2011-4510Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and…

  • CVE-2012-0979Feb 2, 2012
    TWiki
    Twiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile, involving (1) registration or (2) editing of the user.

  • CVE-2012-0976Feb 2, 2012
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party…

  • CVE-2012-0975Feb 2, 2012
    Clixint
    Image Hosting Script Dpi
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in misc.php in Image Hosting Script DPI 1.0, 1.3, and earlier allows remote attackers to inject arbitrary web script or HTML via the showseries parameter.

  • CVE-2012-0446Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension, related to improper…

  • CVE-2012-0782Jan 30, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor…

  • CVE-2012-0936Jan 29, 2012
    Opennms
    Opennms
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username…

  • CVE-2011-5070Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref,…