CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 902 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-18454 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2019 | An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS. | ||
| CVE-2019-19129 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2019 | Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name. | ||
| CVE-2015-9539 | Med | 0.40 | 6.1 | 0.02 | Nov 26, 2019 | The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS. | ||
| CVE-2019-15994 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2019 | A vulnerability in the web-based management interface of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is… | ||
| CVE-2019-15973 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2019 | A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected application. The vulnerability is due to… | ||
| CVE-2019-10771 | Med | 0.40 | 6.1 | 0.01 | Nov 25, 2019 | Characters in the GET url path are not properly escaped and can be reflected in the server response. | ||
| CVE-2011-3373 | Med | 0.40 | 6.1 | 0.01 | Nov 25, 2019 | Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that… | ||
| CVE-2019-17632 | Med | 0.40 | 6.1 | 0.02 | Nov 25, 2019 | In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output. | ||
| CVE-2019-17405 | Med | 0.40 | 6.1 | 0.01 | Nov 25, 2019 | Nokia IMPACT < 18A: has Reflected self XSS | ||
| CVE-2014-2214 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to… | ||
| CVE-2014-1238 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2019 | Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier. | ||
| CVE-2013-6878 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2019 | Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search. | ||
| CVE-2013-6239 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2019 | Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter in a detail action. | ||
| CVE-2019-15652 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2019 | The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code. | ||
| CVE-2013-6880 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2019 | Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header. | ||
| CVE-2012-0812 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2019 | PostfixAdmin 2.3.4 has multiple XSS vulnerabilities | ||
| CVE-2015-2793 | Med | 0.40 | 6.1 | 0.02 | Nov 21, 2019 | Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi. | ||
| CVE-2019-6853 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2019 | A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server. | ||
| CVE-2011-4455 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2019 | Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php, (2) tiki-pagehistory.php, (3) tiki-removepage.php, or (4) tiki-rename_page.php. | ||
| CVE-2011-4454 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2019 | Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-remind_password.php, (2) tiki-index.php, (3) tiki-login_scr.php, or (4) tiki-index. |
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.
- risk 0.40cvss 6.1epss 0.01
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.
- risk 0.40cvss 6.1epss 0.02
The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected application. The vulnerability is due to…
- risk 0.40cvss 6.1epss 0.01
Characters in the GET url path are not properly escaped and can be reflected in the server response.
- risk 0.40cvss 6.1epss 0.01
Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that…
- risk 0.40cvss 6.1epss 0.02
In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.
- risk 0.40cvss 6.1epss 0.01
Nokia IMPACT < 18A: has Reflected self XSS
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter in a detail action.
- risk 0.40cvss 6.1epss 0.01
The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.
- risk 0.40cvss 6.1epss 0.01
Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.
- risk 0.40cvss 6.1epss 0.01
PostfixAdmin 2.3.4 has multiple XSS vulnerabilities
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.
- risk 0.40cvss 6.1epss 0.01
A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php, (2) tiki-pagehistory.php, (3) tiki-removepage.php, or (4) tiki-rename_page.php.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-remind_password.php, (2) tiki-index.php, (3) tiki-login_scr.php, or (4) tiki-index.