CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,306)
page 877 of 1,166| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-24710 | 0.00 | — | 0.01 | Feb 25, 2022 | Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The… | |||
| CVE-2021-37504 | — | 0.00 | — | 0.01 | Feb 25, 2022 | A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name. | ||
| CVE-2022-24948 | — | 0.00 | — | 0.02 | Feb 25, 2022 | A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.… | ||
| CVE-2021-45229 | 0.00 | — | 0.03 | Feb 25, 2022 | It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below. | |||
| CVE-2022-24709 | — | 0.00 | — | 0.01 | Feb 24, 2022 | @awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for… | ||
| CVE-2022-0719 | 0.00 | — | 0.01 | Feb 23, 2022 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3. | |||
| CVE-2021-44566 | — | 0.00 | — | 0.01 | Feb 22, 2022 | A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php. | ||
| CVE-2021-44565 | — | 0.00 | — | 0.01 | Feb 22, 2022 | A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields. | ||
| CVE-2022-0690 | 0.00 | — | 0.01 | Feb 19, 2022 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. | |||
| CVE-2022-0678 | 0.00 | — | 0.02 | Feb 19, 2022 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. | |||
| CVE-2022-23647 | 0.00 | — | 0.01 | Feb 18, 2022 | Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text… | |||
| CVE-2022-0612 | 0.00 | — | 0.01 | Feb 16, 2022 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | |||
| CVE-2022-25203 | 0.00 | — | 0.01 | Feb 15, 2022 | Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission. | |||
| CVE-2022-25202 | 0.00 | — | 0.01 | Feb 15, 2022 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission. | |||
| CVE-2022-25191 | 0.00 | — | 0.01 | Feb 15, 2022 | Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||
| CVE-2022-25189 | 0.00 | — | 0.01 | Feb 15, 2022 | Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||
| CVE-2022-25185 | 0.00 | — | 0.01 | Feb 15, 2022 | Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||
| CVE-2022-0589 | 0.00 | — | 0.01 | Feb 15, 2022 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0. | |||
| CVE-2022-23638 | 0.00 | — | 0.01 | Feb 14, 2022 | svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available. | |||
| CVE-2022-0575 | 0.00 | — | 0.01 | Feb 13, 2022 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0. |
- CVE-2022-24710Feb 25, 2022risk 0.00cvss —epss 0.01
Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The…
- CVE-2021-37504Feb 25, 2022risk 0.00cvss —epss 0.01
A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.
- CVE-2022-24948Feb 25, 2022risk 0.00cvss —epss 0.02
A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.…
- CVE-2021-45229Feb 25, 2022risk 0.00cvss —epss 0.03
It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.
- CVE-2022-24709Feb 24, 2022risk 0.00cvss —epss 0.01
@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for…
- CVE-2022-0719Feb 23, 2022risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
- CVE-2021-44566Feb 22, 2022risk 0.00cvss —epss 0.01
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
- CVE-2021-44565Feb 22, 2022risk 0.00cvss —epss 0.01
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.
- CVE-2022-0690Feb 19, 2022risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
- CVE-2022-0678Feb 19, 2022risk 0.00cvss —epss 0.02
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
- CVE-2022-23647Feb 18, 2022risk 0.00cvss —epss 0.01
Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text…
- CVE-2022-0612Feb 16, 2022risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- CVE-2022-25203Feb 15, 2022risk 0.00cvss —epss 0.01
Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
- CVE-2022-25202Feb 15, 2022risk 0.00cvss —epss 0.01
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
- CVE-2022-25191Feb 15, 2022risk 0.00cvss —epss 0.01
Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- CVE-2022-25189Feb 15, 2022risk 0.00cvss —epss 0.01
Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- CVE-2022-25185Feb 15, 2022risk 0.00cvss —epss 0.01
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- CVE-2022-0589Feb 15, 2022risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
- CVE-2022-23638Feb 14, 2022risk 0.00cvss —epss 0.01
svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
- CVE-2022-0575Feb 13, 2022risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.