CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,294)
page 906 of 1,165| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-13870 | — | 0.00 | — | 0.01 | Jun 5, 2020 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name. | ||
| CVE-2020-5298 | 0.00 | — | 0.01 | Jun 3, 2020 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which… | |||
| CVE-2020-13596 | — | 0.00 | — | 0.03 | Jun 3, 2020 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. | ||
| CVE-2020-2195 | 0.00 | — | 0.01 | Jun 3, 2020 | Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission. | |||
| CVE-2020-2194 | 0.00 | — | 0.01 | Jun 3, 2020 | Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability. | |||
| CVE-2020-2193 | 0.00 | — | 0.01 | Jun 3, 2020 | Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability. | |||
| CVE-2020-2190 | 0.00 | — | 0.01 | Jun 3, 2020 | Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability. | |||
| CVE-2018-18625 | — | 0.00 | — | 0.01 | Jun 2, 2020 | Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. | ||
| CVE-2018-18624 | — | 0.00 | — | 0.01 | Jun 2, 2020 | Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. | ||
| CVE-2018-18623 | — | 0.00 | — | 0.02 | Jun 2, 2020 | Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. | ||
| CVE-2020-11082 | 0.00 | — | 0.02 | May 28, 2020 | In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1. | |||
| CVE-2020-13633 | — | 0.00 | — | 0.01 | May 27, 2020 | Fork before 5.8.3 allows XSS via navigation_title or title. | ||
| CVE-2020-13487 | — | 0.00 | — | 0.01 | May 26, 2020 | The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit… | ||
| CVE-2020-13459 | — | 0.00 | — | 0.01 | May 25, 2020 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action. | ||
| CVE-2020-13430 | — | 0.00 | — | 0.02 | May 24, 2020 | Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. | ||
| CVE-2020-13258 | — | 0.00 | — | 0.02 | May 21, 2020 | Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py. | ||
| CVE-2020-13239 | — | 0.00 | — | 0.01 | May 20, 2020 | The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS. | ||
| CVE-2020-13240 | — | 0.00 | — | 0.01 | May 20, 2020 | The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS. | ||
| CVE-2020-7656 | 0.00 | — | 0.06 | May 19, 2020 | jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "", which results in the enclosed script logic to be executed. | |||
| CVE-2020-13094 | — | 0.00 | — | 0.01 | May 18, 2020 | Dolibarr before 11.0.4 allows XSS. |
- CVE-2020-13870Jun 5, 2020risk 0.00cvss —epss 0.01
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.
- CVE-2020-5298Jun 3, 2020risk 0.00cvss —epss 0.01
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which…
- CVE-2020-13596Jun 3, 2020risk 0.00cvss —epss 0.03
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
- CVE-2020-2195Jun 3, 2020risk 0.00cvss —epss 0.01
Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.
- CVE-2020-2194Jun 3, 2020risk 0.00cvss —epss 0.01
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
- CVE-2020-2193Jun 3, 2020risk 0.00cvss —epss 0.01
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.
- CVE-2020-2190Jun 3, 2020risk 0.00cvss —epss 0.01
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
- CVE-2018-18625Jun 2, 2020risk 0.00cvss —epss 0.01
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
- CVE-2018-18624Jun 2, 2020risk 0.00cvss —epss 0.01
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
- CVE-2018-18623Jun 2, 2020risk 0.00cvss —epss 0.02
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
- CVE-2020-11082May 28, 2020risk 0.00cvss —epss 0.02
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
- CVE-2020-13633May 27, 2020risk 0.00cvss —epss 0.01
Fork before 5.8.3 allows XSS via navigation_title or title.
- CVE-2020-13487May 26, 2020risk 0.00cvss —epss 0.01
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit…
- CVE-2020-13459May 25, 2020risk 0.00cvss —epss 0.01
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.
- CVE-2020-13430May 24, 2020risk 0.00cvss —epss 0.02
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.
- CVE-2020-13258May 21, 2020risk 0.00cvss —epss 0.02
Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
- CVE-2020-13239May 20, 2020risk 0.00cvss —epss 0.01
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
- CVE-2020-13240May 20, 2020risk 0.00cvss —epss 0.01
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
- CVE-2020-7656May 19, 2020risk 0.00cvss —epss 0.06
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "", which results in the enclosed script logic to be executed.
- CVE-2020-13094May 18, 2020risk 0.00cvss —epss 0.01
Dolibarr before 11.0.4 allows XSS.