CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 893 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-3121 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient… | ||
| CVE-2019-16024 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | A vulnerability in the web-based management interface of Cisco Crosswork Change Automation could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability… | ||
| CVE-2019-16015 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The… | ||
| CVE-2019-15278 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2020 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the software fails to sanitize URLs before it… | ||
| CVE-2012-6494 | Med | 0.40 | 6.1 | 0.01 | Jan 25, 2020 | Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain unauthorized access. | ||
| CVE-2012-6344 | Med | 0.40 | 6.1 | 0.01 | Jan 25, 2020 | Novell ZENworks Configuration Management before 11.2.4 allows XSS. | ||
| CVE-2019-19632 | Med | 0.40 | 6.1 | 0.01 | Jan 24, 2020 | An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. An… | ||
| CVE-2014-7238 | Med | 0.40 | 6.1 | 0.01 | Jan 23, 2020 | The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS | ||
| CVE-2011-3622 | Med | 0.40 | 6.1 | 0.01 | Jan 22, 2020 | A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18. | ||
| CVE-2011-3610 | Med | 0.40 | 6.1 | 0.01 | Jan 22, 2020 | A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf. | ||
| CVE-2018-17981 | Med | 0.40 | 6.1 | 0.01 | Jan 22, 2020 | Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter. | ||
| CVE-2019-19592 | Med | 0.40 | 6.1 | 0.01 | Jan 21, 2020 | Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting | ||
| CVE-2020-7239 | Med | 0.40 | 6.1 | 0.01 | Jan 21, 2020 | The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent. | ||
| CVE-2020-7236 | Med | 0.40 | 6.1 | 0.01 | Jan 19, 2020 | UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section). | ||
| CVE-2020-7235 | Med | 0.40 | 6.1 | 0.01 | Jan 19, 2020 | UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cB3?ta= (profile title). | ||
| CVE-2020-7104 | Med | 0.40 | 6.1 | 0.02 | Jan 17, 2020 | The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter. | ||
| CVE-2019-17127 | Med | 0.40 | 6.1 | 0.02 | Jan 17, 2020 | A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege… | ||
| CVE-2019-17125 | Med | 0.40 | 6.1 | 0.02 | Jan 17, 2020 | A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. | ||
| CVE-2019-20003 | Med | 0.40 | 6.1 | 0.01 | Jan 17, 2020 | Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attacker sends an crafted string for FTP authentication. | ||
| CVE-2019-11997 | Med | 0.40 | 6.1 | 0.01 | Jan 16, 2020 | A potential security vulnerability has been identified in HPE enhanced Internet Usage Manager (eIUM) versions 8.3 and 9.0. The vulnerability could be used for unauthorized access to information via cross site scripting. HPE has made the following software updates to resolve the… |
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Crosswork Change Automation could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the software fails to sanitize URLs before it…
- risk 0.40cvss 6.1epss 0.01
Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain unauthorized access.
- risk 0.40cvss 6.1epss 0.01
Novell ZENworks Configuration Management before 11.2.4 allows XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. An…
- risk 0.40cvss 6.1epss 0.01
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
- risk 0.40cvss 6.1epss 0.01
A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf.
- risk 0.40cvss 6.1epss 0.01
Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.
- risk 0.40cvss 6.1epss 0.01
Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.
- risk 0.40cvss 6.1epss 0.01
UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section).
- risk 0.40cvss 6.1epss 0.01
UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cB3?ta= (profile title).
- risk 0.40cvss 6.1epss 0.02
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
- risk 0.40cvss 6.1epss 0.02
A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege…
- risk 0.40cvss 6.1epss 0.02
A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.
- risk 0.40cvss 6.1epss 0.01
Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attacker sends an crafted string for FTP authentication.
- risk 0.40cvss 6.1epss 0.01
A potential security vulnerability has been identified in HPE enhanced Internet Usage Manager (eIUM) versions 8.3 and 9.0. The vulnerability could be used for unauthorized access to information via cross site scripting. HPE has made the following software updates to resolve the…