CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 866 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-11556 | Med | 0.40 | 6.1 | 0.01 | Sep 25, 2020 | Pagure before 5.6 allows XSS via the templates/blame.html blame view. | ||
| CVE-2017-17477 | Med | 0.40 | 6.1 | 0.01 | Sep 25, 2020 | Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views. | ||
| CVE-2020-8348 | Med | 0.40 | 6.1 | 0.01 | Sep 24, 2020 | A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's current browser session if a crafted url is visited, possibly through phishing. | ||
| CVE-2020-8347 | Med | 0.40 | 6.1 | 0.01 | Sep 24, 2020 | A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's browser if a crafted url is visited, possibly through phishing. | ||
| CVE-2020-12816 | Med | 0.40 | 6.1 | 0.01 | Sep 24, 2020 | An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users. | ||
| CVE-2020-22453 | Med | 0.40 | 6.1 | 0.01 | Sep 24, 2020 | Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information. | ||
| CVE-2020-3137 | Med | 0.40 | 6.1 | 0.01 | Sep 23, 2020 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The… | ||
| CVE-2019-15969 | Med | 0.40 | 6.1 | 0.01 | Sep 23, 2020 | A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface of an affected device. The vulnerability is due to… | ||
| CVE-2020-14024 | Med | 0.40 | 6.1 | 0.01 | Sep 22, 2020 | Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining… | ||
| CVE-2020-4731 | Med | 0.40 | 6.1 | 0.01 | Sep 21, 2020 | IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2020-25789 | Med | 0.40 | 6.1 | 0.01 | Sep 19, 2020 | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document. | ||
| CVE-2020-25786 | Med | 0.40 | 6.1 | 0.01 | Sep 19, 2020 | webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: this is typically not exploitable because of URL encoding… | ||
| CVE-2020-8245 | Med | 0.40 | 6.1 | 0.01 | Sep 18, 2020 | Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12,… | ||
| CVE-2020-15769 | Med | 0.40 | 6.1 | 0.01 | Sep 18, 2020 | An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL. | ||
| CVE-2020-5606 | Med | 0.40 | 6.1 | 0.01 | Sep 18, 2020 | Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially crafted page. | ||
| CVE-2020-25735 | Med | 0.40 | 6.1 | 0.01 | Sep 18, 2020 | webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editproject.php, and general/newnotifications.php. | ||
| CVE-2020-25729 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2020 | ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php. | ||
| CVE-2020-13928 | Med | 0.40 | 6.1 | 0.03 | Sep 16, 2020 | Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability. | ||
| CVE-2020-10748 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2020 | A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks. | ||
| CVE-2020-10227 | Med | 0.40 | 6.1 | 0.01 | Sep 14, 2020 | A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript code via the From field of an email. |
- risk 0.40cvss 6.1epss 0.01
Pagure before 5.6 allows XSS via the templates/blame.html blame view.
- risk 0.40cvss 6.1epss 0.01
Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views.
- risk 0.40cvss 6.1epss 0.01
A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's current browser session if a crafted url is visited, possibly through phishing.
- risk 0.40cvss 6.1epss 0.01
A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's browser if a crafted url is visited, possibly through phishing.
- risk 0.40cvss 6.1epss 0.01
An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users.
- risk 0.40cvss 6.1epss 0.01
Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface of an affected device. The vulnerability is due to…
- risk 0.40cvss 6.1epss 0.01
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining…
- risk 0.40cvss 6.1epss 0.01
IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document.
- risk 0.40cvss 6.1epss 0.01
webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: this is typically not exploitable because of URL encoding…
- risk 0.40cvss 6.1epss 0.01
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12,…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially crafted page.
- risk 0.40cvss 6.1epss 0.01
webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editproject.php, and general/newnotifications.php.
- risk 0.40cvss 6.1epss 0.01
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.
- risk 0.40cvss 6.1epss 0.03
Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript code via the From field of an email.