CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 850 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-20665 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2021 | Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium… | ||
| CVE-2021-20664 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2021 | Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type… | ||
| CVE-2021-20663 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2021 | Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable… | ||
| CVE-2021-23130 | Med | 0.40 | 6.1 | 0.01 | Mar 4, 2021 | An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues. | ||
| CVE-2021-23129 | Med | 0.40 | 6.1 | 0.01 | Mar 4, 2021 | An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues. | ||
| CVE-2020-24912 | Med | 0.40 | 6.1 | 0.06 | Mar 4, 2021 | A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. | ||
| CVE-2020-25902 | Med | 0.40 | 6.1 | 0.01 | Mar 2, 2021 | Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room, which leads to stealing cookies from users who join the class. NOTE: Third-parties dispute the validity of this entry as a possible false… | ||
| CVE-2020-1936 | Med | 0.40 | 6.1 | 0.03 | Mar 2, 2021 | A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4. | ||
| CVE-2021-27888 | Med | 0.40 | 6.1 | 0.01 | Mar 2, 2021 | ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters. | ||
| CVE-2021-27731 | Med | 0.40 | 6.1 | 0.01 | Mar 2, 2021 | Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later. | ||
| CVE-2021-26702 | Med | 0.40 | 6.1 | 0.03 | Mar 1, 2021 | EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI. | ||
| CVE-2021-26475 | Med | 0.40 | 6.1 | 0.07 | Mar 1, 2021 | EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. | ||
| CVE-2021-27318 | Med | 0.40 | 6.1 | 0.01 | Mar 1, 2021 | Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the lastname parameter. | ||
| CVE-2021-27317 | Med | 0.40 | 6.1 | 0.01 | Mar 1, 2021 | Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the comment parameter. | ||
| CVE-2021-26903 | Med | 0.40 | 6.1 | 0.01 | Feb 26, 2021 | LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text']. | ||
| CVE-2021-23959 | Med | 0.40 | 6.1 | 0.01 | Feb 26, 2021 | An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85. | ||
| CVE-2021-1724 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2021 | Microsoft Dynamics Business Central Cross-site Scripting Vulnerability | ||
| CVE-2021-27330 | Med | 0.40 | 6.1 | 0.06 | Feb 25, 2021 | Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file… | ||
| CVE-2021-26682 | Med | 0.40 | 6.1 | 0.01 | Feb 23, 2021 | A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected… | ||
| CVE-2021-26678 | Med | 0.40 | 6.1 | 0.01 | Feb 23, 2021 | A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface of ClearPass could allow an unauthenticated remote… |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.
- risk 0.40cvss 6.1epss 0.06
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
- risk 0.40cvss 6.1epss 0.01
Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room, which leads to stealing cookies from users who join the class. NOTE: Third-parties dispute the validity of this entry as a possible false…
- risk 0.40cvss 6.1epss 0.03
A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
- risk 0.40cvss 6.1epss 0.01
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.
- risk 0.40cvss 6.1epss 0.01
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.
- risk 0.40cvss 6.1epss 0.03
EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.
- risk 0.40cvss 6.1epss 0.07
EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the lastname parameter.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the comment parameter.
- risk 0.40cvss 6.1epss 0.01
LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text'].
- risk 0.40cvss 6.1epss 0.01
An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
- risk 0.40cvss 6.1epss 0.01
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
- risk 0.40cvss 6.1epss 0.06
Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file…
- risk 0.40cvss 6.1epss 0.01
A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected…
- risk 0.40cvss 6.1epss 0.01
A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface of ClearPass could allow an unauthenticated remote…