CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 772 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-43018 | Med | 0.40 | 6.1 | 0.02 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. | ||
| CVE-2022-43017 | Med | 0.40 | 6.1 | 0.02 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. | ||
| CVE-2022-43016 | Med | 0.40 | 6.1 | 0.02 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. | ||
| CVE-2022-43015 | Med | 0.40 | 6.1 | 0.02 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. | ||
| CVE-2022-43014 | Med | 0.40 | 6.1 | 0.02 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. | ||
| CVE-2022-21639 | Med | 0.40 | 6.1 | 0.01 | Oct 18, 2022 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search Integration). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to… | ||
| CVE-2022-21631 | Med | 0.40 | 6.1 | 0.01 | Oct 18, 2022 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). Supported versions that are affected are 9.2.6.4 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise… | ||
| CVE-2022-21606 | Med | 0.40 | 6.1 | 0.01 | Oct 18, 2022 | Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services… | ||
| CVE-2022-42202 | Med | 0.40 | 6.1 | 0.01 | Oct 18, 2022 | TP-Link TL-WR841N 8.0 4.17.16 Build 120201 Rel.54750n is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2022-22242 | Med | 0.40 | 6.1 | 0.03 | Oct 18, 2022 | A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper… | ||
| CVE-2022-42147 | Med | 0.40 | 6.1 | 0.01 | Oct 17, 2022 | kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java. | ||
| CVE-2022-40606 | Med | 0.40 | 6.1 | 0.01 | Oct 17, 2022 | MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40605. | ||
| CVE-2022-40605 | Med | 0.40 | 6.1 | 0.01 | Oct 17, 2022 | MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40606. | ||
| CVE-2022-3149 | Med | 0.40 | 6.1 | 0.00 | Oct 17, 2022 | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some… | ||
| CVE-2022-42071 | Med | 0.40 | 6.1 | 0.00 | Oct 14, 2022 | Online Birth Certificate Management System version 1.0 suffers from a Cross Site Scripting (XSS) Vulnerability. | ||
| CVE-2022-42066 | Med | 0.40 | 6.1 | 0.01 | Oct 14, 2022 | Online Examination System version 1.0 suffers from a cross site scripting vulnerability via index.php. | ||
| CVE-2022-39295 | Med | 0.40 | 6.1 | 0.01 | Oct 13, 2022 | Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the… | ||
| CVE-2022-41473 | Med | 0.40 | 6.1 | 0.01 | Oct 13, 2022 | RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function. | ||
| CVE-2022-41351 | Med | 0.40 | 6.1 | 0.01 | Oct 12, 2022 | In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (instead of default value of 10). | ||
| CVE-2022-41350 | Med | 0.40 | 6.1 | 0.01 | Oct 12, 2022 | In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine. |
- risk 0.40cvss 6.1epss 0.02
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
- risk 0.40cvss 6.1epss 0.02
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
- risk 0.40cvss 6.1epss 0.02
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.
- risk 0.40cvss 6.1epss 0.02
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.
- risk 0.40cvss 6.1epss 0.02
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
- risk 0.40cvss 6.1epss 0.01
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search Integration). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…
- risk 0.40cvss 6.1epss 0.01
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). Supported versions that are affected are 9.2.6.4 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
- risk 0.40cvss 6.1epss 0.01
Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services…
- risk 0.40cvss 6.1epss 0.01
TP-Link TL-WR841N 8.0 4.17.16 Build 120201 Rel.54750n is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.03
A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper…
- risk 0.40cvss 6.1epss 0.01
kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java.
- risk 0.40cvss 6.1epss 0.01
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40605.
- risk 0.40cvss 6.1epss 0.01
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40606.
- risk 0.40cvss 6.1epss 0.00
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some…
- risk 0.40cvss 6.1epss 0.00
Online Birth Certificate Management System version 1.0 suffers from a Cross Site Scripting (XSS) Vulnerability.
- risk 0.40cvss 6.1epss 0.01
Online Examination System version 1.0 suffers from a cross site scripting vulnerability via index.php.
- risk 0.40cvss 6.1epss 0.01
Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the…
- risk 0.40cvss 6.1epss 0.01
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
- risk 0.40cvss 6.1epss 0.01
In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (instead of default value of 10).
- risk 0.40cvss 6.1epss 0.01
In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine.