CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 892 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-4632 | Med | 0.40 | 6.1 | 0.01 | Jan 28, 2020 | IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2013-6451 | Med | 0.40 | 6.1 | 0.01 | Jan 28, 2020 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values. | ||
| CVE-2020-7997 | Med | 0.40 | 6.1 | 0.01 | Jan 28, 2020 | ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature. | ||
| CVE-2019-15586 | Med | 0.40 | 6.1 | 0.01 | Jan 28, 2020 | A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin. | ||
| CVE-2020-1933 | Med | 0.40 | 6.1 | 0.03 | Jan 28, 2020 | A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers. | ||
| CVE-2019-20437 | — | Med | 0.40 | 6.1 | 0.01 | Jan 28, 2020 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that… | |
| CVE-2019-20436 | — | Med | 0.40 | 6.1 | 0.01 | Jan 28, 2020 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim… | |
| CVE-2019-10779 | Med | 0.40 | 6.1 | 0.01 | Jan 28, 2020 | All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom… | ||
| CVE-2019-8947 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS. | ||
| CVE-2019-8946 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | ||
| CVE-2019-8945 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | ||
| CVE-2019-15313 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. | ||
| CVE-2014-5500 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Synacor Zimbra Collaboration before 8.0.8 has XSS. | ||
| CVE-2013-4770 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-6036 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2020 | Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2020-7996 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. | ||
| CVE-2020-7994 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the… | ||
| CVE-2020-7990 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | Adive Framework 2.0.8 has admin/user/add userName XSS. | ||
| CVE-2020-7989 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | Adive Framework 2.0.8 has admin/user/add userUsername XSS. | ||
| CVE-2020-3136 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | A vulnerability in the web-based management interface of Cisco Jabber Guest could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because… |
- risk 0.40cvss 6.1epss 0.01
IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.
- risk 0.40cvss 6.1epss 0.01
ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.
- risk 0.40cvss 6.1epss 0.01
A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
- risk 0.40cvss 6.1epss 0.03
A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim…
- risk 0.40cvss 6.1epss 0.01
All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom…
- risk 0.40cvss 6.1epss 0.01
Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS.
- risk 0.40cvss 6.1epss 0.01
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
- risk 0.40cvss 6.1epss 0.01
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
- risk 0.40cvss 6.1epss 0.01
In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
Synacor Zimbra Collaboration before 8.0.8 has XSS.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the…
- risk 0.40cvss 6.1epss 0.01
Adive Framework 2.0.8 has admin/user/add userName XSS.
- risk 0.40cvss 6.1epss 0.01
Adive Framework 2.0.8 has admin/user/add userUsername XSS.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Jabber Guest could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because…