CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 931 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-14667 | Med | 0.40 | 6.1 | 0.01 | Aug 5, 2019 | Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action. | ||
| CVE-2019-11198 | Med | 0.40 | 6.1 | 0.01 | Aug 5, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4)… | ||
| CVE-2017-18472 | Med | 0.40 | 6.1 | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198). | ||
| CVE-2019-14653 | Med | 0.40 | 6.1 | 0.01 | Aug 3, 2019 | pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element. | ||
| CVE-2019-6968 | Med | 0.40 | 6.1 | 0.01 | Aug 2, 2019 | The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected. | ||
| CVE-2017-18456 | Med | 0.40 | 6.1 | 0.01 | Aug 2, 2019 | cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217). | ||
| CVE-2019-14517 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | pandao Editor.md 1.5.0 allows XSS via the Javascript: string. | ||
| CVE-2018-20953 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389). | ||
| CVE-2018-20951 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387). | ||
| CVE-2018-20950 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386). | ||
| CVE-2018-20949 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385). | ||
| CVE-2018-20948 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383). | ||
| CVE-2018-20928 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391). | ||
| CVE-2019-14472 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO. | ||
| CVE-2019-14471 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | TestLink 1.9.19 has XSS via the error.php message parameter. | ||
| CVE-2018-20923 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377). | ||
| CVE-2018-20922 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376). | ||
| CVE-2018-20921 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375). | ||
| CVE-2018-20920 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374). | ||
| CVE-2018-20919 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373). |
- risk 0.40cvss 6.1epss 0.01
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4)…
- risk 0.40cvss 6.1epss 0.01
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
- risk 0.40cvss 6.1epss 0.01
pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
- risk 0.40cvss 6.1epss 0.01
The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.
- risk 0.40cvss 6.1epss 0.01
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
- risk 0.40cvss 6.1epss 0.01
pandao Editor.md 1.5.0 allows XSS via the Javascript: string.
- risk 0.40cvss 6.1epss 0.01
cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).
- risk 0.40cvss 6.1epss 0.01
cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).
- risk 0.40cvss 6.1epss 0.01
cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).
- risk 0.40cvss 6.1epss 0.01
cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).
- risk 0.40cvss 6.1epss 0.01
cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391).
- risk 0.40cvss 6.1epss 0.01
Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
- risk 0.40cvss 6.1epss 0.01
TestLink 1.9.19 has XSS via the error.php message parameter.
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376).
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375).
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374).
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373).