CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 871 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-16275 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2020 | A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link. | ||
| CVE-2020-17480 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2020 | TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor. | ||
| CVE-2020-17476 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2020 | Mibew Messenger before 3.2.7 allows XSS via a crafted user name. | ||
| CVE-2020-4541 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2020 | IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2020-4539 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2020 | IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within… | ||
| CVE-2020-4533 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2020 | IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2020-15831 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2020 | JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI. | ||
| CVE-2020-15830 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2020 | JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI. | ||
| CVE-2020-15907 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2020 | In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript. | ||
| CVE-2020-9036 | Med | 0.40 | 6.1 | 0.04 | Aug 5, 2020 | Jeedom through 4.0.38 allows XSS. | ||
| CVE-2020-16192 | Med | 0.40 | 6.1 | 0.01 | Aug 5, 2020 | LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters. | ||
| CVE-2020-17364 | Med | 0.40 | 6.1 | 0.01 | Aug 5, 2020 | USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs. | ||
| CVE-2020-13819 | Med | 0.40 | 6.1 | 0.01 | Aug 5, 2020 | Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. | ||
| CVE-2020-16847 | Med | 0.40 | 6.1 | 0.01 | Aug 4, 2020 | Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887. | ||
| CVE-2020-11584 | Med | 0.40 | 6.1 | 0.01 | Aug 3, 2020 | A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. | ||
| CVE-2020-11583 | Med | 0.40 | 6.1 | 0.01 | Aug 3, 2020 | A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. | ||
| CVE-2020-16131 | Med | 0.40 | 6.1 | 0.01 | Aug 3, 2020 | Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php. | ||
| CVE-2020-13820 | Med | 0.40 | 6.1 | 0.04 | Aug 3, 2020 | Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. | ||
| CVE-2015-9549 | Med | 0.40 | 6.1 | 0.01 | Aug 3, 2020 | A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php. | ||
| CVE-2020-4560 | Med | 0.40 | 6.1 | 0.01 | Aug 3, 2020 | IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
- risk 0.40cvss 6.1epss 0.01
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
- risk 0.40cvss 6.1epss 0.01
Mibew Messenger before 3.2.7 allows XSS via a crafted user name.
- risk 0.40cvss 6.1epss 0.01
IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.40cvss 6.1epss 0.01
IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…
- risk 0.40cvss 6.1epss 0.01
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.40cvss 6.1epss 0.01
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.
- risk 0.40cvss 6.1epss 0.01
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.
- risk 0.40cvss 6.1epss 0.01
In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript.
- risk 0.40cvss 6.1epss 0.04
Jeedom through 4.0.38 allows XSS.
- risk 0.40cvss 6.1epss 0.01
LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.
- risk 0.40cvss 6.1epss 0.01
USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.
- risk 0.40cvss 6.1epss 0.01
Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
- risk 0.40cvss 6.1epss 0.01
Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
- risk 0.40cvss 6.1epss 0.01
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
- risk 0.40cvss 6.1epss 0.01
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
- risk 0.40cvss 6.1epss 0.01
Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.
- risk 0.40cvss 6.1epss 0.04
Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php.
- risk 0.40cvss 6.1epss 0.01
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.