CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 875 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-14164 | Med | 0.40 | 6.1 | 0.01 | Jul 1, 2020 | The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field. | ||
| CVE-2020-15307 | Med | 0.40 | 6.1 | 0.01 | Jun 30, 2020 | Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name. | ||
| CVE-2020-14413 | Med | 0.40 | 6.1 | 0.03 | Jun 29, 2020 | NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a… | ||
| CVE-2020-14071 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2020 | An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code. | ||
| CVE-2020-12635 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2020 | XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field. | ||
| CVE-2020-9577 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2020 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure . | ||
| CVE-2020-15017 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2020 | NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter. | ||
| CVE-2020-15016 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2020 | NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter. | ||
| CVE-2020-7355 | Med | 0.40 | 6.1 | 0.01 | Jun 25, 2020 | Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the… | ||
| CVE-2020-7354 | Med | 0.40 | 6.1 | 0.01 | Jun 25, 2020 | Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the… | ||
| CVE-2020-15015 | Med | 0.40 | 6.1 | 0.01 | Jun 24, 2020 | The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document. | ||
| CVE-2020-14018 | Med | 0.40 | 6.1 | 0.01 | Jun 24, 2020 | An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the… | ||
| CVE-2020-13483 | Med | 0.40 | 6.1 | 0.05 | Jun 24, 2020 | The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. | ||
| CVE-2020-4323 | Med | 0.40 | 6.1 | 0.01 | Jun 24, 2020 | IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2019-3865 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2020 | A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name. | ||
| CVE-2020-14973 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2020 | The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string. | ||
| CVE-2020-13427 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2020 | Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter. | ||
| CVE-2020-14202 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2020 | WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters. | ||
| CVE-2017-18921 | Med | 0.40 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. | ||
| CVE-2017-18913 | Med | 0.40 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. |
- risk 0.40cvss 6.1epss 0.01
The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.
- risk 0.40cvss 6.1epss 0.01
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name.
- risk 0.40cvss 6.1epss 0.03
NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.
- risk 0.40cvss 6.1epss 0.01
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure .
- risk 0.40cvss 6.1epss 0.01
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter.
- risk 0.40cvss 6.1epss 0.01
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the…
- risk 0.40cvss 6.1epss 0.01
Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the…
- risk 0.40cvss 6.1epss 0.01
The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the…
- risk 0.40cvss 6.1epss 0.05
The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.
- risk 0.40cvss 6.1epss 0.01
IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.40cvss 6.1epss 0.01
A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.
- risk 0.40cvss 6.1epss 0.01
The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
- risk 0.40cvss 6.1epss 0.01
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.
- risk 0.40cvss 6.1epss 0.01
WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.