CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 932 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-20918 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372). | ||
| CVE-2018-20910 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357). | ||
| CVE-2018-20903 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421). | ||
| CVE-2018-20901 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400). | ||
| CVE-2013-7474 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users. | ||
| CVE-2018-20900 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399). | ||
| CVE-2018-20899 | Med | 0.40 | 6.1 | 0.01 | Aug 1, 2019 | cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398). | ||
| CVE-2019-14338 | Med | 0.40 | 6.1 | 0.02 | Aug 1, 2019 | An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface. | ||
| CVE-2019-7000 | Med | 0.40 | 6.1 | 0.01 | Jul 31, 2019 | A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not… | ||
| CVE-2018-20859 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem. | ||
| CVE-2019-14406 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). | ||
| CVE-2018-20868 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464). | ||
| CVE-2018-20866 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461). | ||
| CVE-2018-20865 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459). | ||
| CVE-2019-14387 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506). | ||
| CVE-2018-18570 | Med | 0.40 | 6.1 | 0.02 | Jul 29, 2019 | Planon before Live Build 41 has XSS. | ||
| CVE-2015-6960 | Med | 0.40 | 6.1 | 0.01 | Jul 29, 2019 | edx-platform before 2015-09-17 allows XSS via a team name. | ||
| CVE-2019-1020008 | Med | 0.40 | 6.1 | 0.01 | Jul 29, 2019 | stacktable.js before 1.0.4 allows XSS. | ||
| CVE-2019-1020019 | Med | 0.40 | 6.1 | 0.01 | Jul 29, 2019 | invenio-previewer before 1.0.0a12 allows XSS. | ||
| CVE-2019-1020010 | Med | 0.40 | 6.1 | 0.01 | Jul 29, 2019 | Misskey before 10.102.4 allows hijacking a user's token. |
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372).
- risk 0.40cvss 6.1epss 0.01
cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).
- risk 0.40cvss 6.1epss 0.01
cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).
- risk 0.40cvss 6.1epss 0.01
cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).
- risk 0.40cvss 6.1epss 0.01
Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users.
- risk 0.40cvss 6.1epss 0.01
cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).
- risk 0.40cvss 6.1epss 0.01
cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).
- risk 0.40cvss 6.1epss 0.02
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface.
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not…
- risk 0.40cvss 6.1epss 0.01
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
- risk 0.40cvss 6.1epss 0.01
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
- risk 0.40cvss 6.1epss 0.01
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
- risk 0.40cvss 6.1epss 0.01
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
- risk 0.40cvss 6.1epss 0.01
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
- risk 0.40cvss 6.1epss 0.01
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
- risk 0.40cvss 6.1epss 0.02
Planon before Live Build 41 has XSS.
- risk 0.40cvss 6.1epss 0.01
edx-platform before 2015-09-17 allows XSS via a team name.
- risk 0.40cvss 6.1epss 0.01
stacktable.js before 1.0.4 allows XSS.
- risk 0.40cvss 6.1epss 0.01
invenio-previewer before 1.0.0a12 allows XSS.
- risk 0.40cvss 6.1epss 0.01
Misskey before 10.102.4 allows hijacking a user's token.