CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,306)
page 894 of 1,166| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-21418 | 0.00 | — | 0.01 | Mar 31, 2021 | ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1 | |||
| CVE-2021-21635 | 0.00 | — | 0.09 | Mar 30, 2021 | Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||
| CVE-2021-21630 | 0.00 | — | 0.72 | Mar 30, 2021 | Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||
| CVE-2021-21628 | 0.00 | — | 0.82 | Mar 30, 2021 | Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||
| CVE-2021-29272 | — | 0.00 | — | 0.01 | Mar 27, 2021 | bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string. | ||
| CVE-2021-21333 | 0.00 | — | 0.01 | Mar 26, 2021 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring… | |||
| CVE-2021-21332 | 0.00 | — | 0.01 | Mar 26, 2021 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting… | |||
| CVE-2020-19626 | — | 0.00 | — | 0.01 | Mar 26, 2021 | Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new. | ||
| CVE-2021-20683 | 0.00 | — | 0.01 | Mar 26, 2021 | Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors. | |||
| CVE-2021-20681 | 0.00 | — | 0.01 | Mar 26, 2021 | Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors. | |||
| CVE-2021-29002 | — | 0.00 | — | 0.01 | Mar 24, 2021 | A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. | ||
| CVE-2021-20222 | 0.00 | — | 0.01 | Mar 23, 2021 | A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. | |||
| CVE-2021-21370 | 0.00 | — | 0.01 | Mar 23, 2021 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the… | |||
| CVE-2021-21340 | 0.00 | — | 0.01 | Mar 23, 2021 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user… | |||
| CVE-2021-21358 | 0.00 | — | 0.01 | Mar 23, 2021 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the… | |||
| CVE-2021-28957 | — | 0.00 | — | 0.04 | Mar 21, 2021 | An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit… | ||
| CVE-2020-6578 | — | 0.00 | — | 0.01 | Mar 19, 2021 | Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php. | ||
| CVE-2021-28145 | — | 0.00 | — | 0.01 | Mar 18, 2021 | Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges. | ||
| CVE-2021-28796 | — | 0.00 | — | 0.01 | Mar 18, 2021 | Increments Qiita::Markdown before 0.33.0 allows XSS in transformers. | ||
| CVE-2021-28380 | — | 0.00 | — | 0.01 | Mar 16, 2021 | The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account. |
- CVE-2021-21418Mar 31, 2021risk 0.00cvss —epss 0.01
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- CVE-2021-21635Mar 30, 2021risk 0.00cvss —epss 0.09
Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- CVE-2021-21630Mar 30, 2021risk 0.00cvss —epss 0.72
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- CVE-2021-21628Mar 30, 2021risk 0.00cvss —epss 0.82
Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- CVE-2021-29272Mar 27, 2021risk 0.00cvss —epss 0.01
bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
- CVE-2021-21333Mar 26, 2021risk 0.00cvss —epss 0.01
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring…
- CVE-2021-21332Mar 26, 2021risk 0.00cvss —epss 0.01
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting…
- CVE-2020-19626Mar 26, 2021risk 0.00cvss —epss 0.01
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
- CVE-2021-20683Mar 26, 2021risk 0.00cvss —epss 0.01
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
- CVE-2021-20681Mar 26, 2021risk 0.00cvss —epss 0.01
Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
- CVE-2021-29002Mar 24, 2021risk 0.00cvss —epss 0.01
A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.
- CVE-2021-20222Mar 23, 2021risk 0.00cvss —epss 0.01
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- CVE-2021-21370Mar 23, 2021risk 0.00cvss —epss 0.01
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the…
- CVE-2021-21340Mar 23, 2021risk 0.00cvss —epss 0.01
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user…
- CVE-2021-21358Mar 23, 2021risk 0.00cvss —epss 0.01
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the…
- CVE-2021-28957Mar 21, 2021risk 0.00cvss —epss 0.04
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit…
- CVE-2020-6578Mar 19, 2021risk 0.00cvss —epss 0.01
Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.
- CVE-2021-28145Mar 18, 2021risk 0.00cvss —epss 0.01
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
- CVE-2021-28796Mar 18, 2021risk 0.00cvss —epss 0.01
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
- CVE-2021-28380Mar 16, 2021risk 0.00cvss —epss 0.01
The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.