CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,177)
page 929 of 1,159| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-12097 | — | 0.00 | — | 0.00 | Jan 19, 2018 | An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An… | ||
| CVE-2017-12098 | — | 0.00 | — | 0.00 | Jan 19, 2018 | An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser.… | ||
| CVE-2012-6708 | — | 0.00 | — | 0.01 | Jan 18, 2018 | jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere… | ||
| CVE-2015-9251 | — | 0.00 | — | 0.18 | Jan 18, 2018 | jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. | ||
| CVE-2018-5773 | — | 0.00 | — | 0.00 | Jan 18, 2018 | An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the… | ||
| CVE-2018-5362 | — | 0.00 | — | 0.00 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php. | ||
| CVE-2018-5363 | — | 0.00 | — | 0.00 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php. | ||
| CVE-2018-5364 | — | 0.00 | — | 0.00 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php. | ||
| CVE-2018-5365 | — | 0.00 | — | 0.00 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php. | ||
| CVE-2018-5366 | — | 0.00 | — | 0.00 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php. | ||
| CVE-2018-5367 | — | 0.00 | — | 0.00 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php. | ||
| CVE-2016-6810 | 0.00 | — | 0.03 | Jan 10, 2018 | In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation. | |||
| CVE-2017-15717 | 0.00 | — | 0.02 | Jan 10, 2018 | A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling… | |||
| CVE-2018-5215 | — | 0.00 | — | 0.00 | Jan 4, 2018 | Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter. | ||
| CVE-2018-5216 | — | 0.00 | — | 0.00 | Jan 4, 2018 | Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource. | ||
| CVE-2017-17837 | 0.00 | — | 0.02 | Jan 4, 2018 | The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1. | |||
| CVE-2018-1190 | — | 0.00 | — | 0.00 | Jan 4, 2018 | An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId… | ||
| CVE-2017-1000482 | — | 0.00 | — | 0.00 | Jan 3, 2018 | A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page. | ||
| CVE-2017-1000488 | — | 0.00 | — | 0.00 | Jan 3, 2018 | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form. | ||
| CVE-2017-1000467 | — | 0.00 | — | 0.00 | Jan 3, 2018 | LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code. |
- CVE-2017-12097Jan 19, 2018risk 0.00cvss —epss 0.00
An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An…
- CVE-2017-12098Jan 19, 2018risk 0.00cvss —epss 0.00
An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser.…
- CVE-2012-6708Jan 18, 2018risk 0.00cvss —epss 0.01
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere…
- CVE-2015-9251Jan 18, 2018risk 0.00cvss —epss 0.18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
- CVE-2018-5773Jan 18, 2018risk 0.00cvss —epss 0.00
An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the…
- CVE-2018-5362Jan 12, 2018risk 0.00cvss —epss 0.00
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
- CVE-2018-5363Jan 12, 2018risk 0.00cvss —epss 0.00
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
- CVE-2018-5364Jan 12, 2018risk 0.00cvss —epss 0.00
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
- CVE-2018-5365Jan 12, 2018risk 0.00cvss —epss 0.00
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
- CVE-2018-5366Jan 12, 2018risk 0.00cvss —epss 0.00
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
- CVE-2018-5367Jan 12, 2018risk 0.00cvss —epss 0.00
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
- CVE-2016-6810Jan 10, 2018risk 0.00cvss —epss 0.03
In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
- CVE-2017-15717Jan 10, 2018risk 0.00cvss —epss 0.02
A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling…
- CVE-2018-5215Jan 4, 2018risk 0.00cvss —epss 0.00
Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.
- CVE-2018-5216Jan 4, 2018risk 0.00cvss —epss 0.00
Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.
- CVE-2017-17837Jan 4, 2018risk 0.00cvss —epss 0.02
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.
- CVE-2018-1190Jan 4, 2018risk 0.00cvss —epss 0.00
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId…
- CVE-2017-1000482Jan 3, 2018risk 0.00cvss —epss 0.00
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
- CVE-2017-1000488Jan 3, 2018risk 0.00cvss —epss 0.00
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.
- CVE-2017-1000467Jan 3, 2018risk 0.00cvss —epss 0.00
LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.