CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 884 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-9344 | Med | 0.40 | 6.1 | 0.05 | Mar 20, 2020 | Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations. | ||
| CVE-2019-16069 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through the SNMP protocol. | ||
| CVE-2020-10670 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version. | ||
| CVE-2020-10668 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version. | ||
| CVE-2020-10667 | Med | 0.40 | 6.1 | 0.02 | Mar 19, 2020 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is map(template_name). NOTE: this is fixed in the latest version. | ||
| CVE-2019-15124 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33. | ||
| CVE-2019-20526 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. | ||
| CVE-2019-20525 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. | ||
| CVE-2019-20521 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. | ||
| CVE-2019-20520 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. | ||
| CVE-2019-20519 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. | ||
| CVE-2019-20518 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. | ||
| CVE-2019-20517 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. | ||
| CVE-2019-20516 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. | ||
| CVE-2019-20515 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. | ||
| CVE-2019-20514 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. | ||
| CVE-2019-20513 | Med | 0.40 | 6.1 | 0.00 | Mar 19, 2020 | Open edX Ironwood.1 allows support/certificates?user= reflected XSS. | ||
| CVE-2019-16070 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs. | ||
| CVE-2019-20527 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. | ||
| CVE-2019-20524 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter. |
- risk 0.40cvss 6.1epss 0.05
Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
- risk 0.40cvss 6.1epss 0.01
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through the SNMP protocol.
- risk 0.40cvss 6.1epss 0.01
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version.
- risk 0.40cvss 6.1epss 0.01
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version.
- risk 0.40cvss 6.1epss 0.02
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is map(template_name). NOTE: this is fixed in the latest version.
- risk 0.40cvss 6.1epss 0.01
In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33.
- risk 0.40cvss 6.1epss 0.01
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
- risk 0.40cvss 6.1epss 0.01
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
- risk 0.40cvss 6.1epss 0.00
Open edX Ironwood.1 allows support/certificates?user= reflected XSS.
- risk 0.40cvss 6.1epss 0.01
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs.
- risk 0.40cvss 6.1epss 0.01
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
- risk 0.40cvss 6.1epss 0.01
ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.