CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 880 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-19515 | Med | 0.40 | 6.1 | 0.01 | May 5, 2020 | Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings. | ||
| CVE-2020-11737 | Med | 0.40 | 6.1 | 0.02 | May 5, 2020 | A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including… | ||
| CVE-2017-18866 | Med | 0.40 | 6.1 | 0.01 | May 5, 2020 | Certain NETGEAR devices are affected by stored XSS. This affects R9000 before 1.0.2.40, R6100 before 1.0.1.1, 6R7500 before 1.0.0.110, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, WNDR4300v2 before 1.0.0.48, and WNR2000v5 before 1.0.0.58. | ||
| CVE-2020-12639 | Med | 0.40 | 6.1 | 0.01 | May 4, 2020 | phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. | ||
| CVE-2020-12625 | Med | 0.40 | 6.1 | 0.03 | May 4, 2020 | An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message. | ||
| CVE-2020-6579 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2020 | Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.php in the MailBeez plugin for ZenCart before 3.9.22 allows remote attackers to inject arbitrary web script or HTML via the cloudloader_mode parameter. | ||
| CVE-2020-10797 | Med | 0.40 | 6.1 | 0.02 | Apr 29, 2020 | An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed. | ||
| CVE-2020-5568 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2020 | Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 5.0.0 allows remote attackers to inject arbitrary web script or HTML via the applications 'Messages' and 'Bulletin Board'. | ||
| CVE-2020-5564 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2020 | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the application 'E-mail'. | ||
| CVE-2018-21155 | Med | 0.40 | 6.1 | 0.01 | Apr 27, 2020 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.52, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R8900 before 1.0.4.2, R9000 before 1.0.3.16, WNDR4300 before 1.0.2.98,… | ||
| CVE-2020-11822 | Med | 0.40 | 6.1 | 0.01 | Apr 27, 2020 | In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data. | ||
| CVE-2020-12052 | Med | 0.40 | 6.1 | 0.01 | Apr 27, 2020 | Grafana version < 6.7.3 is vulnerable for annotation popup XSS. | ||
| CVE-2020-6213 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2020 | SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL parameters as it does not sufficiently encode user controlled… | ||
| CVE-2017-18701 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2020 | Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34. | ||
| CVE-2017-18700 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2020 | Certain NETGEAR devices are affected by stored XSS. This affects D6400 before 1.0.0.60, D7000 before 1.0.1.50, D8500 before 1.0.3.29, EX6200 before 1.0.3.84, EX7000 before 1.0.0.60, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44,… | ||
| CVE-2017-18715 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2020 | Certain NETGEAR devices are affected by reflected XSS. This affects EX3700 before 1.0.0.66, EX3800 before 1.0.0.66, EX6100 before 1.0.2.20, EX6120 before 1.0.0.34, EX6150 before 1.0.0.36, EX6200 before 1.0.3.84, and EX7000 before 1.0.0.60. | ||
| CVE-2020-12137 | Med | 0.40 | 6.1 | 0.02 | Apr 24, 2020 | GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform… | ||
| CVE-2020-12132 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2020 | Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request. | ||
| CVE-2020-12131 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2020 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo). | ||
| CVE-2020-12130 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2020 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function. |
- risk 0.40cvss 6.1epss 0.01
Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings.
- risk 0.40cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including…
- risk 0.40cvss 6.1epss 0.01
Certain NETGEAR devices are affected by stored XSS. This affects R9000 before 1.0.2.40, R6100 before 1.0.1.1, 6R7500 before 1.0.0.110, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, WNDR4300v2 before 1.0.0.48, and WNR2000v5 before 1.0.0.58.
- risk 0.40cvss 6.1epss 0.01
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.
- risk 0.40cvss 6.1epss 0.03
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.php in the MailBeez plugin for ZenCart before 3.9.22 allows remote attackers to inject arbitrary web script or HTML via the cloudloader_mode parameter.
- risk 0.40cvss 6.1epss 0.02
An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 5.0.0 allows remote attackers to inject arbitrary web script or HTML via the applications 'Messages' and 'Bulletin Board'.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the application 'E-mail'.
- risk 0.40cvss 6.1epss 0.01
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.52, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R8900 before 1.0.4.2, R9000 before 1.0.3.16, WNDR4300 before 1.0.2.98,…
- risk 0.40cvss 6.1epss 0.01
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data.
- risk 0.40cvss 6.1epss 0.01
Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
- risk 0.40cvss 6.1epss 0.01
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL parameters as it does not sufficiently encode user controlled…
- risk 0.40cvss 6.1epss 0.01
Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34.
- risk 0.40cvss 6.1epss 0.01
Certain NETGEAR devices are affected by stored XSS. This affects D6400 before 1.0.0.60, D7000 before 1.0.1.50, D8500 before 1.0.3.29, EX6200 before 1.0.3.84, EX7000 before 1.0.0.60, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44,…
- risk 0.40cvss 6.1epss 0.01
Certain NETGEAR devices are affected by reflected XSS. This affects EX3700 before 1.0.0.66, EX3800 before 1.0.0.66, EX6100 before 1.0.2.20, EX6120 before 1.0.0.34, EX6150 before 1.0.0.36, EX6200 before 1.0.3.84, and EX7000 before 1.0.0.60.
- risk 0.40cvss 6.1epss 0.02
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform…
- risk 0.40cvss 6.1epss 0.01
Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.
- risk 0.40cvss 6.1epss 0.01
The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).
- risk 0.40cvss 6.1epss 0.01
The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.