CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 904 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-18883 | Med | 0.40 | 6.1 | 0.01 | Nov 13, 2019 | XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. | ||
| CVE-2019-18793 | Med | 0.40 | 6.1 | 0.01 | Nov 13, 2019 | Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter. | ||
| CVE-2019-16950 | Med | 0.40 | 6.1 | 0.01 | Nov 13, 2019 | An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript. | ||
| CVE-2014-3592 | Med | 0.40 | 6.1 | 0.01 | Nov 13, 2019 | OpenShift Origin: Improperly validated team names could allow stored XSS attacks | ||
| CVE-2010-3857 | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2019 | JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter. | ||
| CVE-2019-18926 | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2019 | Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS). A user input (related to dialog information) is reflected directly in the web page, allowing a malicious user to conduct a Cross Site Scripting attack… | ||
| CVE-2019-17236 | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2019 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. | ||
| CVE-2011-3370 | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2019 | statusnet before 0.9.9 has XSS | ||
| CVE-2019-18882 | — | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2019 | WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled. | |
| CVE-2019-18881 | — | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2019 | WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile. | |
| CVE-2009-2802 | Med | 0.40 | 6.1 | 0.01 | Nov 9, 2019 | MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks. | ||
| CVE-2019-4645 | Med | 0.40 | 6.1 | 0.01 | Nov 9, 2019 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2019-4581 | Med | 0.40 | 6.1 | 0.01 | Nov 9, 2019 | IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2019-4450 | Med | 0.40 | 6.1 | 0.01 | Nov 9, 2019 | IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2018-18674 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2019 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_update.php bo_content_tail parameter. | ||
| CVE-2010-2250 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2019 | Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack. | ||
| CVE-2019-18816 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2019 | po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS. | ||
| CVE-2019-17222 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2019 | An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial of service (inability to change the configuration). | ||
| CVE-2009-5046 | Med | 0.40 | 6.1 | 0.02 | Nov 6, 2019 | JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22. | ||
| CVE-2016-1000037 | Med | 0.40 | 6.1 | 0.01 | Nov 6, 2019 | Pagure: XSS possible in file attachment endpoint |
- risk 0.40cvss 6.1epss 0.01
XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
- risk 0.40cvss 6.1epss 0.01
Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.
- risk 0.40cvss 6.1epss 0.01
OpenShift Origin: Improperly validated team names could allow stored XSS attacks
- risk 0.40cvss 6.1epss 0.01
JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.
- risk 0.40cvss 6.1epss 0.01
Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS). A user input (related to dialog information) is reflected directly in the web page, allowing a malicious user to conduct a Cross Site Scripting attack…
- risk 0.40cvss 6.1epss 0.01
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
- risk 0.40cvss 6.1epss 0.01
statusnet before 0.9.9 has XSS
- risk 0.40cvss 6.1epss 0.01
WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.
- risk 0.40cvss 6.1epss 0.01
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
- risk 0.40cvss 6.1epss 0.01
MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks.
- risk 0.40cvss 6.1epss 0.01
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.40cvss 6.1epss 0.01
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.40cvss 6.1epss 0.01
IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.40cvss 6.1epss 0.01
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_update.php bo_content_tail parameter.
- risk 0.40cvss 6.1epss 0.01
Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.
- risk 0.40cvss 6.1epss 0.01
po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial of service (inability to change the configuration).
- risk 0.40cvss 6.1epss 0.02
JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.
- risk 0.40cvss 6.1epss 0.01
Pagure: XSS possible in file attachment endpoint