CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,177)
page 917 of 1,159| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-11003 | 0.00 | — | 0.00 | Apr 8, 2019 | In Materialize through 1.0.0, XSS is possible via the Autocomplete feature. | |||
| CVE-2019-11002 | 0.00 | — | 0.00 | Apr 8, 2019 | In Materialize through 1.0.0, XSS is possible via the Tooltip feature. | |||
| CVE-2019-10905 | 0.00 | — | 0.01 | Apr 6, 2019 | Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are… | |||
| CVE-2019-10904 | 0.00 | — | 0.01 | Apr 6, 2019 | Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. | |||
| CVE-2019-5422 | — | 0.00 | — | 0.00 | Apr 3, 2019 | XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server. | ||
| CVE-2019-0224 | — | 0.00 | — | 0.02 | Mar 28, 2019 | In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser. | ||
| CVE-2019-1003042 | 0.00 | — | 0.00 | Mar 28, 2019 | A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin. | |||
| CVE-2019-10260 | 0.00 | — | 0.00 | Mar 28, 2019 | Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). | |||
| CVE-2016-10744 | 0.00 | — | 0.01 | Mar 27, 2019 | In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data. | |||
| CVE-2019-10118 | 0.00 | — | 0.00 | Mar 27, 2019 | Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API. | |||
| CVE-2019-3847 | 0.00 | — | 0.01 | Mar 27, 2019 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was… | |||
| CVE-2019-6341 | 0.00 | — | 0.47 | Mar 26, 2019 | In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability. | |||
| CVE-2019-3826 | 0.00 | — | 0.02 | Mar 26, 2019 | A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary… | |||
| CVE-2019-3808 | 0.00 | — | 0.00 | Mar 25, 2019 | A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is… | |||
| CVE-2019-10010 | 0.00 | — | 0.00 | Mar 24, 2019 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than… | |||
| CVE-2018-14486 | 0.00 | — | 0.00 | Mar 17, 2019 | DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML. | |||
| CVE-2018-19917 | 0.00 | — | 0.01 | Mar 17, 2019 | Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities. | |||
| CVE-2019-9844 | 0.00 | — | 0.00 | Mar 15, 2019 | simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI. | |||
| CVE-2019-9737 | 0.00 | — | 0.00 | Mar 13, 2019 | Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. | |||
| CVE-2019-9644 | 0.00 | — | 0.01 | Mar 12, 2019 | An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer… |
- CVE-2019-11003Apr 8, 2019risk 0.00cvss —epss 0.00
In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.
- CVE-2019-11002Apr 8, 2019risk 0.00cvss —epss 0.00
In Materialize through 1.0.0, XSS is possible via the Tooltip feature.
- CVE-2019-10905Apr 6, 2019risk 0.00cvss —epss 0.01
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are…
- CVE-2019-10904Apr 6, 2019risk 0.00cvss —epss 0.01
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
- CVE-2019-5422Apr 3, 2019risk 0.00cvss —epss 0.00
XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.
- CVE-2019-0224Mar 28, 2019risk 0.00cvss —epss 0.02
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.
- CVE-2019-1003042Mar 28, 2019risk 0.00cvss —epss 0.00
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
- CVE-2019-10260Mar 28, 2019risk 0.00cvss —epss 0.00
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
- CVE-2016-10744Mar 27, 2019risk 0.00cvss —epss 0.01
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
- CVE-2019-10118Mar 27, 2019risk 0.00cvss —epss 0.00
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
- CVE-2019-3847Mar 27, 2019risk 0.00cvss —epss 0.01
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was…
- CVE-2019-6341Mar 26, 2019risk 0.00cvss —epss 0.47
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
- CVE-2019-3826Mar 26, 2019risk 0.00cvss —epss 0.02
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary…
- CVE-2019-3808Mar 25, 2019risk 0.00cvss —epss 0.00
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is…
- CVE-2019-10010Mar 24, 2019risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than…
- CVE-2018-14486Mar 17, 2019risk 0.00cvss —epss 0.00
DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.
- CVE-2018-19917Mar 17, 2019risk 0.00cvss —epss 0.01
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
- CVE-2019-9844Mar 15, 2019risk 0.00cvss —epss 0.00
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
- CVE-2019-9737Mar 13, 2019risk 0.00cvss —epss 0.00
Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
- CVE-2019-9644Mar 12, 2019risk 0.00cvss —epss 0.01
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer…