CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 889 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-6850 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2020 | Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element. | ||
| CVE-2020-9028 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2020 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user). | ||
| CVE-2020-9025 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2020 | Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script. | ||
| CVE-2020-9022 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2020 | An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS. | ||
| CVE-2020-9012 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2020 | A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter. | ||
| CVE-2019-13966 | Med | 0.40 | 6.1 | 0.01 | Feb 14, 2020 | In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title). | ||
| CVE-2019-13965 | Med | 0.40 | 6.1 | 0.02 | Feb 14, 2020 | Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the… | ||
| CVE-2020-8981 | Med | 0.40 | 6.1 | 0.01 | Feb 13, 2020 | A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related… | ||
| CVE-2020-7051 | Med | 0.40 | 6.1 | 0.01 | Feb 13, 2020 | Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover. | ||
| CVE-2019-14652 | Med | 0.40 | 6.1 | 0.01 | Feb 13, 2020 | explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances. | ||
| CVE-2020-7208 | Med | 0.40 | 6.1 | 0.01 | Feb 13, 2020 | LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. | ||
| CVE-2020-6973 | Med | 0.40 | 6.2 | 0.01 | Feb 13, 2020 | Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vulnerabilities exist that could allow an attacker to cause a denial-of-service condition. | ||
| CVE-2013-6022 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2020 | A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code. | ||
| CVE-2020-6193 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2020 | SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2020-6184 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2020 | Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2011-2499 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2020 | Mambo CMS through 4.6.5 has multiple XSS. | ||
| CVE-2013-4395 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2020 | Simple Machines Forum (SMF) through 2.0.5 has XSS | ||
| CVE-2011-4938 | Med | 0.40 | 6.1 | 0.01 | Feb 11, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in Ariadne 2.7.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO parameter to (1) index.php and (2) loader.php. | ||
| CVE-2012-6720 | Med | 0.40 | 6.1 | 0.01 | Feb 11, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to music/create, (2) location parameter to events/create, or (3) search parameter to… | ||
| CVE-2013-5988 | Med | 0.40 | 6.1 | 0.01 | Feb 11, 2020 | A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter. |
- risk 0.40cvss 6.1epss 0.01
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.
- risk 0.40cvss 6.1epss 0.01
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user).
- risk 0.40cvss 6.1epss 0.01
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
- risk 0.40cvss 6.1epss 0.01
In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).
- risk 0.40cvss 6.1epss 0.02
Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the…
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related…
- risk 0.40cvss 6.1epss 0.01
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover.
- risk 0.40cvss 6.1epss 0.01
explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances.
- risk 0.40cvss 6.1epss 0.01
LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2.
- risk 0.40cvss 6.2epss 0.01
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vulnerabilities exist that could allow an attacker to cause a denial-of-service condition.
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code.
- risk 0.40cvss 6.1epss 0.01
SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
Mambo CMS through 4.6.5 has multiple XSS.
- risk 0.40cvss 6.1epss 0.01
Simple Machines Forum (SMF) through 2.0.5 has XSS
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Ariadne 2.7.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO parameter to (1) index.php and (2) loader.php.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to music/create, (2) location parameter to events/create, or (3) search parameter to…
- risk 0.40cvss 6.1epss 0.01
A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.