VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,563)

page 903 of 2,429
  • CVE-2010-4659MedNov 20, 2019
    Status
    Statusnet
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.

  • CVE-2013-0195MedNov 20, 2019
    Piwik
    Piwik
    risk 0.40cvss 6.1epss 0.01

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.

  • CVE-2013-0194MedNov 20, 2019
    Piwik
    Piwik
    risk 0.40cvss 6.1epss 0.01

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.

  • CVE-2013-0193MedNov 20, 2019
    Piwik
    Piwik
    risk 0.40cvss 6.1epss 0.01

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.

  • CVE-2019-15072MedNov 20, 2019
    MAIL2000
    MAIL2000
    risk 0.40cvss 6.1epss 0.02

    The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and…

  • CVE-2019-15071MedNov 20, 2019
    Openfind
    Mail2000
    risk 0.40cvss 6.1epss 0.02

    The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many…

  • CVE-2019-15054MedNov 18, 2019
    Mailbird
    Mailbird
    risk 0.40cvss 6.1epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a privileged context via a crafted HTML mail message. This vulnerability is distinct from CVE-2015-4657.

  • CVE-2019-10070MedNov 18, 2019
    Apache
    Atlas
    risk 0.40cvss 6.1epss 0.02

    Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality

  • CVE-2012-4439MedNov 18, 2019
    Jenkins Project
    Jenkins
    risk 0.40cvss 6.1epss 0.02

    Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.

  • CVE-2019-12311MedNov 18, 2019
    Sandline
    Centraleyezer
    risk 0.40cvss 6.1epss 0.01

    Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded.

  • CVE-2019-12299MedNov 18, 2019
    Sandline
    Centraleyezer
    risk 0.40cvss 6.1epss 0.01

    Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.

  • CVE-2019-17057MedNov 18, 2019
    Footy
    Tipping Software
    risk 0.40cvss 6.1epss 0.01

    Footy Tipping Software AFL Web Edition 2019 allows XSS.

  • CVE-2019-19040MedNov 17, 2019
    Kairosdb Project
    Kairosdb
    risk 0.40cvss 6.1epss 0.01

    KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"' substring.

  • CVE-2013-4106MedNov 14, 2019
    Cryptocat
    Cryptocat
    risk 0.40cvss 6.1epss 0.01

    A Cross-site scripting (XSS) vulnerability exists in Conversation Overview Nickname in Cryptocat before 2.0.22.

  • CVE-2013-4109MedNov 14, 2019
    Cryptocat
    Cryptocat
    risk 0.40cvss 6.1epss 0.02

    An unspecified cross-site scripting (XSS) vulnerability exists in Cryptocat Message Handling 1.1.165.

  • CVE-2019-18957MedNov 14, 2019
    MicroStrategy
    Library
    risk 0.40cvss 6.1epss 0.05

    Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.

  • CVE-2011-0544MedNov 14, 2019
    PhpBB
    phpBB
    risk 0.40cvss 6.1epss 0.01

    phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.

  • CVE-2013-3097MedNov 13, 2019
    Actiontec
    Mi424wr Gen3i Firmware
    risk 0.40cvss 6.1epss 0.01

    Unspecified Cross-site scripting (XSS) vulnerability in the Verizon FIOS Actiontec MI424WR-GEN3I router.

  • CVE-2019-17550MedNov 13, 2019
    WordPress
    Blog2social
    risk 0.40cvss 6.1epss 0.01

    The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2s_id parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the…

  • CVE-2019-17515MedNov 13, 2019
    Cleantalk
    Spam Protection, Antispam, Firewall By Cleantalk
    risk 0.40cvss 6.1epss 0.01

    The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and…