CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 921 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-5594 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI. | ||
| CVE-2019-13422 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login. | ||
| CVE-2019-11584 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority. | ||
| CVE-2019-15492 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21. | ||
| CVE-2019-15488 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test. | ||
| CVE-2019-15487 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | DfE School Experience before v16333-GA has XSS via a teacher training URL. | ||
| CVE-2019-15485 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php. | ||
| CVE-2019-15484 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | Bolt before 3.6.10 has XSS via an image's alt or title field. | ||
| CVE-2019-15483 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | Bolt before 3.6.10 has XSS via a title that is mishandled in the system log. | ||
| CVE-2019-15482 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | selectize-plugin-a11y before 1.1.0 has XSS via the msg field. | ||
| CVE-2019-15481 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | Kimai v2 before 1.1 has XSS via a timesheet description. | ||
| CVE-2019-15476 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | Former before 4.2.1 has XSS via a checkbox value. | ||
| CVE-2019-15499 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL. | ||
| CVE-2019-15328 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. | ||
| CVE-2019-15327 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. | ||
| CVE-2017-18579 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The corner-ad plugin before 1.0.8 for WordPress has XSS. | ||
| CVE-2017-18578 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS. | ||
| CVE-2014-10393 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The cforms2 plugin before 10.5 for WordPress has XSS. | ||
| CVE-2019-15331 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. | ||
| CVE-2014-10392 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The cforms2 plugin before 10.2 for WordPress has XSS. |
- risk 0.40cvss 6.1epss 0.01
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
- risk 0.40cvss 6.1epss 0.01
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login.
- risk 0.40cvss 6.1epss 0.01
The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.
- risk 0.40cvss 6.1epss 0.01
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
- risk 0.40cvss 6.1epss 0.01
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
- risk 0.40cvss 6.1epss 0.01
DfE School Experience before v16333-GA has XSS via a teacher training URL.
- risk 0.40cvss 6.1epss 0.01
Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.
- risk 0.40cvss 6.1epss 0.01
Bolt before 3.6.10 has XSS via an image's alt or title field.
- risk 0.40cvss 6.1epss 0.01
Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.
- risk 0.40cvss 6.1epss 0.01
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
- risk 0.40cvss 6.1epss 0.01
Kimai v2 before 1.1 has XSS via a timesheet description.
- risk 0.40cvss 6.1epss 0.01
Former before 4.2.1 has XSS via a checkbox value.
- risk 0.40cvss 6.1epss 0.01
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.
- risk 0.40cvss 6.1epss 0.01
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
- risk 0.40cvss 6.1epss 0.01
The corner-ad plugin before 1.0.8 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 10.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 10.2 for WordPress has XSS.