CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 935 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-12475 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2019 | In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. | ||
| CVE-2019-1010091 | Med | 0.40 | 6.1 | 0.02 | Jul 17, 2019 | tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab. | ||
| CVE-2018-2021 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2019 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2019-1010018 | Med | 0.40 | 6.1 | 0.01 | Jul 16, 2019 | Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3. | ||
| CVE-2019-0234 | Med | 0.40 | 6.1 | 0.03 | Jul 15, 2019 | A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to… | ||
| CVE-2019-1010028 | Med | 0.40 | 6.1 | 0.01 | Jul 15, 2019 | phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is:… | ||
| CVE-2019-1010016 | Med | 0.40 | 6.1 | 0.01 | Jul 15, 2019 | Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker. | ||
| CVE-2019-1010005 | Med | 0.40 | 6.1 | 0.01 | Jul 15, 2019 | HexoEditor v1.1.8-beta is affected by: XSS to code execution. | ||
| CVE-2019-10933 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2019 | A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Version v4.75), Spectrum Power 5 (Corporate User Interface) (All versions < v5.50), Spectrum Power 7 (Corporate User… | ||
| CVE-2018-17150 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2019 | Intersystems Cache 2017.2.2.865.0 allows XSS. | ||
| CVE-2019-13564 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | XSS exists in Ping Identity Agentless Integration Kit before 1.5. | ||
| CVE-2019-13562 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping6_response.cgi ping6_ipaddr parameter, and the /www/apply_sec.cgi html_response_return_page parameter. | ||
| CVE-2019-12597 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName. | ||
| CVE-2019-12596 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType. | ||
| CVE-2019-12595 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter. | ||
| CVE-2019-12540 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field. | ||
| CVE-2019-12539 | Med | 0.40 | 6.1 | 0.03 | Jul 11, 2019 | An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189. | ||
| CVE-2019-12537 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field. | ||
| CVE-2019-10346 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2019 | A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin. | ||
| CVE-2019-13505 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2019 | The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. |
- risk 0.40cvss 6.1epss 0.01
In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
- risk 0.40cvss 6.1epss 0.02
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.
- risk 0.40cvss 6.1epss 0.01
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.40cvss 6.1epss 0.01
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
- risk 0.40cvss 6.1epss 0.03
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to…
- risk 0.40cvss 6.1epss 0.01
phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is:…
- risk 0.40cvss 6.1epss 0.01
Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.
- risk 0.40cvss 6.1epss 0.01
HexoEditor v1.1.8-beta is affected by: XSS to code execution.
- risk 0.40cvss 6.1epss 0.01
A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Version v4.75), Spectrum Power 5 (Corporate User Interface) (All versions < v5.50), Spectrum Power 7 (Corporate User…
- risk 0.40cvss 6.1epss 0.01
Intersystems Cache 2017.2.2.865.0 allows XSS.
- risk 0.40cvss 6.1epss 0.02
XSS exists in Ping Identity Agentless Integration Kit before 1.5.
- risk 0.40cvss 6.1epss 0.02
D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping6_response.cgi ping6_ipaddr parameter, and the /www/apply_sec.cgi html_response_return_page parameter.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
- risk 0.40cvss 6.1epss 0.03
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.
- risk 0.40cvss 6.1epss 0.02
A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
- risk 0.40cvss 6.1epss 0.01
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.