CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,315)
page 845 of 1,166| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-28331 | 0.00 | — | 0.01 | Mar 23, 2023 | Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. | |||
| CVE-2023-28332 | 0.00 | — | 0.01 | Mar 23, 2023 | If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. | |||
| CVE-2022-45004 | 0.00 | — | 0.01 | Mar 22, 2023 | Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. | |||
| CVE-2023-1535 | — | 0.00 | — | 0.01 | Mar 21, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7. | ||
| CVE-2023-1536 | — | 0.00 | — | 0.01 | Mar 21, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7. | ||
| CVE-2023-28429 | 0.00 | — | 0.01 | Mar 20, 2023 | Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through… | |||
| CVE-2023-1515 | 0.00 | — | 0.00 | Mar 20, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-1517 | 0.00 | — | 0.00 | Mar 20, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-1496 | 0.00 | — | 0.02 | Mar 19, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0. | |||
| CVE-2023-27592 | 0.00 | — | 0.01 | Mar 17, 2023 | Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected Content Security… | |||
| CVE-2023-27494 | — | 0.00 | — | 0.00 | Mar 16, 2023 | Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with… | ||
| CVE-2023-28106 | 0.00 | — | 0.01 | Mar 16, 2023 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch… | |||
| CVE-2023-1429 | 0.00 | — | 0.00 | Mar 16, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-24279 | 0.00 | — | 0.01 | Mar 14, 2023 | A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard. | |||
| CVE-2021-46875 | — | 0.00 | — | 0.00 | Mar 12, 2023 | An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file. | ||
| CVE-2017-20182 | 0.00 | — | 0.01 | Mar 10, 2023 | A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file django_ajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the… | |||
| CVE-2023-1312 | 0.00 | — | 0.00 | Mar 10, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-1286 | 0.00 | — | 0.00 | Mar 9, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-27905 | 0.00 | — | 0.02 | Mar 8, 2023 | Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting. | |||
| CVE-2023-27898 | 0.00 | — | 0.02 | Mar 8, 2023 | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site… |
- CVE-2023-28331Mar 23, 2023risk 0.00cvss —epss 0.01
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
- CVE-2023-28332Mar 23, 2023risk 0.00cvss —epss 0.01
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
- CVE-2022-45004Mar 22, 2023risk 0.00cvss —epss 0.01
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
- CVE-2023-1535Mar 21, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
- CVE-2023-1536Mar 21, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
- CVE-2023-28429Mar 20, 2023risk 0.00cvss —epss 0.01
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through…
- CVE-2023-1515Mar 20, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-1517Mar 20, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-1496Mar 19, 2023risk 0.00cvss —epss 0.02
Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.
- CVE-2023-27592Mar 17, 2023risk 0.00cvss —epss 0.01
Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected Content Security…
- CVE-2023-27494Mar 16, 2023risk 0.00cvss —epss 0.00
Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with…
- CVE-2023-28106Mar 16, 2023risk 0.00cvss —epss 0.01
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch…
- CVE-2023-1429Mar 16, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-24279Mar 14, 2023risk 0.00cvss —epss 0.01
A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
- CVE-2021-46875Mar 12, 2023risk 0.00cvss —epss 0.00
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
- CVE-2017-20182Mar 10, 2023risk 0.00cvss —epss 0.01
A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file django_ajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the…
- CVE-2023-1312Mar 10, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-1286Mar 9, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-27905Mar 8, 2023risk 0.00cvss —epss 0.02
Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
- CVE-2023-27898Mar 8, 2023risk 0.00cvss —epss 0.02
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site…