CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 879 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-8034 | Med | 0.40 | 6.1 | 0.01 | May 18, 2020 | Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access… | ||
| CVE-2019-19456 | Med | 0.40 | 6.1 | 0.01 | May 18, 2020 | A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0. | ||
| CVE-2020-8035 | Med | 0.40 | 6.1 | 0.01 | May 18, 2020 | The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them… | ||
| CVE-2019-20802 | Med | 0.40 | 6.1 | 0.01 | May 18, 2020 | An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user's data. This requires user interaction because there is no known… | ||
| CVE-2019-20389 | Med | 0.40 | 6.1 | 0.01 | May 15, 2020 | An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user's browser without… | ||
| CVE-2020-12685 | Med | 0.40 | 6.1 | 0.01 | May 15, 2020 | XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript. | ||
| CVE-2020-12677 | Med | 0.40 | 6.1 | 0.02 | May 14, 2020 | An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0… | ||
| CVE-2020-5575 | Med | 0.40 | 6.1 | 0.01 | May 14, 2020 | Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7),… | ||
| CVE-2020-6254 | Med | 0.40 | 6.1 | 0.01 | May 12, 2020 | SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting. | ||
| CVE-2020-12708 | Med | 0.40 | 6.1 | 0.01 | May 7, 2020 | Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043. | ||
| CVE-2020-12705 | Med | 0.40 | 6.1 | 0.01 | May 7, 2020 | Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0. | ||
| CVE-2020-12703 | Med | 0.40 | 6.1 | 0.01 | May 7, 2020 | UliCMS before 2020.2 has XSS during PackageController uninstall. | ||
| CVE-2020-5750 | Med | 0.40 | 6.1 | 0.01 | May 7, 2020 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature. | ||
| CVE-2020-5748 | Med | 0.40 | 6.1 | 0.01 | May 7, 2020 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature. | ||
| CVE-2020-12679 | Med | 0.40 | 6.1 | 0.01 | May 7, 2020 | A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php. | ||
| CVE-2020-12696 | Med | 0.40 | 6.1 | 0.02 | May 7, 2020 | The iframe plugin before 4.5 for WordPress does not sanitize a URL. | ||
| CVE-2020-11727 | Med | 0.40 | 6.1 | 0.02 | May 6, 2020 | A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter. | ||
| CVE-2020-3313 | Med | 0.40 | 6.1 | 0.01 | May 6, 2020 | A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to… | ||
| CVE-2020-10630 | Med | 0.40 | 6.1 | 0.01 | May 5, 2020 | SAE IT-systems FW-50 Remote Telemetry Unit (RTU). The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in the output used as a webpage that is served to other users. | ||
| CVE-2020-8033 | Med | 0.40 | 6.1 | 0.01 | May 5, 2020 | Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field. |
- risk 0.40cvss 6.1epss 0.01
Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access…
- risk 0.40cvss 6.1epss 0.01
A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0.
- risk 0.40cvss 6.1epss 0.01
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user's data. This requires user interaction because there is no known…
- risk 0.40cvss 6.1epss 0.01
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user's browser without…
- risk 0.40cvss 6.1epss 0.01
XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7),…
- risk 0.40cvss 6.1epss 0.01
SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.
- risk 0.40cvss 6.1epss 0.01
UliCMS before 2020.2 has XSS during PackageController uninstall.
- risk 0.40cvss 6.1epss 0.01
Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature.
- risk 0.40cvss 6.1epss 0.01
Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature.
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php.
- risk 0.40cvss 6.1epss 0.02
The iframe plugin before 4.5 for WordPress does not sanitize a URL.
- risk 0.40cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to…
- risk 0.40cvss 6.1epss 0.01
SAE IT-systems FW-50 Remote Telemetry Unit (RTU). The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in the output used as a webpage that is served to other users.
- risk 0.40cvss 6.1epss 0.01
Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field.