CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 888 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-2992 | Med | 0.40 | 6.1 | 0.06 | Feb 27, 2020 | Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. | ||
| CVE-2020-8952 | Med | 0.40 | 6.1 | 0.01 | Feb 26, 2020 | Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter. | ||
| CVE-2019-19134 | Med | 0.40 | 6.1 | 0.06 | Feb 26, 2020 | The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript… | ||
| CVE-2020-9405 | Med | 0.40 | 6.1 | 0.01 | Feb 26, 2020 | IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page. | ||
| CVE-2020-9393 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2020 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS. | ||
| CVE-2020-9019 | Med | 0.40 | 6.1 | 0.02 | Feb 25, 2020 | The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. | ||
| CVE-2019-17229 | Med | 0.40 | 6.1 | 0.01 | Feb 24, 2020 | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues. | ||
| CVE-2019-12513 | Med | 0.40 | 6.1 | 0.01 | Feb 24, 2020 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing… | ||
| CVE-2019-12512 | Med | 0.40 | 6.1 | 0.01 | Feb 24, 2020 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative… | ||
| CVE-2019-19865 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2020 | Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored… | ||
| CVE-2020-5533 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2020 | Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2020-8960 | Med | 0.40 | 6.1 | 0.01 | Feb 20, 2020 | Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS. | ||
| CVE-2020-3159 | Med | 0.40 | 6.1 | 0.01 | Feb 19, 2020 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to… | ||
| CVE-2020-3156 | Med | 0.40 | 6.1 | 0.01 | Feb 19, 2020 | A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated remote attacker to conduct cross-site scripting attacks. The vulnerability is due to the improper validation of endpoint data stored in logs used by the web-based interface.… | ||
| CVE-2014-9615 | Med | 0.40 | 6.1 | 0.04 | Feb 19, 2020 | Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php. | ||
| CVE-2014-9608 | Med | 0.40 | 6.1 | 0.05 | Feb 19, 2020 | Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | ||
| CVE-2014-9607 | Med | 0.40 | 6.1 | 0.05 | Feb 19, 2020 | Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter. | ||
| CVE-2014-9606 | Med | 0.40 | 6.1 | 0.04 | Feb 19, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to… | ||
| CVE-2020-6845 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2020 | An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack. | ||
| CVE-2015-5215 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2020 | The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. NOTE:… |
- risk 0.40cvss 6.1epss 0.06
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter.
- risk 0.40cvss 6.1epss 0.06
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript…
- risk 0.40cvss 6.1epss 0.01
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
- risk 0.40cvss 6.1epss 0.02
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
- risk 0.40cvss 6.1epss 0.01
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
- risk 0.40cvss 6.1epss 0.01
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing…
- risk 0.40cvss 6.1epss 0.01
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative…
- risk 0.40cvss 6.1epss 0.01
Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated remote attacker to conduct cross-site scripting attacks. The vulnerability is due to the improper validation of endpoint data stored in logs used by the web-based interface.…
- risk 0.40cvss 6.1epss 0.04
Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php.
- risk 0.40cvss 6.1epss 0.05
Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
- risk 0.40cvss 6.1epss 0.05
Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
- risk 0.40cvss 6.1epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack.
- risk 0.40cvss 6.1epss 0.01
The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. NOTE:…