CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 905 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2009-5049 | Med | 0.40 | 6.1 | 0.02 | Nov 6, 2019 | WebApp JSP Snoop page XSS in jetty though 6.1.21. | ||
| CVE-2009-5048 | Med | 0.40 | 6.1 | 0.02 | Nov 6, 2019 | Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20. | ||
| CVE-2011-4903 | Med | 0.40 | 6.1 | 0.01 | Nov 6, 2019 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function. | ||
| CVE-2011-4626 | Med | 0.40 | 6.1 | 0.01 | Nov 6, 2019 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function. | ||
| CVE-2017-18639 | Med | 0.40 | 6.1 | 0.01 | Nov 6, 2019 | Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title,… | ||
| CVE-2019-13077 | Med | 0.40 | 6.1 | 0.01 | Nov 6, 2019 | Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attacker to create a malicious link in order to attack authenticated users. | ||
| CVE-2019-12917 | Med | 0.40 | 6.1 | 0.01 | Nov 6, 2019 | A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via the PATH_INFO. | ||
| CVE-2019-6142 | Med | 0.40 | 6.1 | 0.01 | Nov 5, 2019 | It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix in order to remediate this issue. | ||
| CVE-2011-1135 | Med | 0.40 | 6.1 | 0.02 | Nov 5, 2019 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php. | ||
| CVE-2011-1133 | Med | 0.40 | 6.1 | 0.02 | Nov 5, 2019 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php. | ||
| CVE-2010-3674 | Med | 0.40 | 6.1 | 0.01 | Nov 5, 2019 | TYPO3 before 4.4.1 allows XSS in the frontend search box. | ||
| CVE-2013-4107 | Med | 0.40 | 6.1 | 0.01 | Nov 5, 2019 | Cryptocat before 2.0.22: cryptocat.js handlePresence() has cross site scripting | ||
| CVE-2014-3649 | Med | 0.40 | 6.1 | 0.01 | Nov 4, 2019 | JBoss AeroGear has reflected XSS via the password field | ||
| CVE-2019-18654 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2019 | A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. | ||
| CVE-2019-18653 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2019 | A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. | ||
| CVE-2013-0186 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2005-2350 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2019 | Cross-site scripting (XSS) vulnerability in websieve v0.62 allows remote attackers to inject arbitrary web script or HTML code in the web user interface. | ||
| CVE-2019-6657 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2019 | On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility. | ||
| CVE-2019-17551 | Med | 0.40 | 6.1 | 0.01 | Oct 31, 2019 | In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes… | ||
| CVE-2010-1673 | Med | 0.40 | 6.1 | 0.01 | Oct 30, 2019 | A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment. |
- risk 0.40cvss 6.1epss 0.02
WebApp JSP Snoop page XSS in jetty though 6.1.21.
- risk 0.40cvss 6.1epss 0.02
Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.
- risk 0.40cvss 6.1epss 0.01
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.
- risk 0.40cvss 6.1epss 0.01
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function.
- risk 0.40cvss 6.1epss 0.01
Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title,…
- risk 0.40cvss 6.1epss 0.01
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attacker to create a malicious link in order to attack authenticated users.
- risk 0.40cvss 6.1epss 0.01
A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via the PATH_INFO.
- risk 0.40cvss 6.1epss 0.01
It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix in order to remediate this issue.
- risk 0.40cvss 6.1epss 0.02
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php.
- risk 0.40cvss 6.1epss 0.02
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php.
- risk 0.40cvss 6.1epss 0.01
TYPO3 before 4.4.1 allows XSS in the frontend search box.
- risk 0.40cvss 6.1epss 0.01
Cryptocat before 2.0.22: cryptocat.js handlePresence() has cross site scripting
- risk 0.40cvss 6.1epss 0.01
JBoss AeroGear has reflected XSS via the password field
- risk 0.40cvss 6.1epss 0.01
A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.
- risk 0.40cvss 6.1epss 0.01
A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in websieve v0.62 allows remote attackers to inject arbitrary web script or HTML code in the web user interface.
- risk 0.40cvss 6.1epss 0.01
On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
- risk 0.40cvss 6.1epss 0.01
In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes…
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.