CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 938 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-11317 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2019 | Subrion CMS before 4.1.4 has XSS. | ||
| CVE-2019-4134 | Med | 0.40 | 6.1 | 0.01 | Jul 2, 2019 | IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2019-1578 | Med | 0.40 | 6.1 | 0.01 | Jul 1, 2019 | Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated MineMeld admin to type malicious input in the MineMeld UI could execute arbitrary JavaScript code in the admin’s browser. | ||
| CVE-2016-5235 | — | Med | 0.40 | 6.1 | 0.01 | Jul 1, 2019 | A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert. | |
| CVE-2019-12970 | Med | 0.40 | 6.1 | 0.02 | Jul 1, 2019 | XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context… | ||
| CVE-2018-20849 | Med | 0.40 | 6.1 | 0.01 | Jun 30, 2019 | Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI. | ||
| CVE-2019-12932 | Med | 0.40 | 6.1 | 0.01 | Jun 28, 2019 | A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.Viewfolder.php. | ||
| CVE-2018-20814 | Med | 0.40 | 6.1 | 0.02 | Jun 28, 2019 | An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX. | ||
| CVE-2018-20808 | Med | 0.40 | 6.1 | 0.02 | Jun 28, 2019 | An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX. | ||
| CVE-2018-20807 | Med | 0.40 | 6.1 | 0.02 | Jun 28, 2019 | An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly. | ||
| CVE-2018-17560 | Med | 0.40 | 6.1 | 0.01 | Jun 28, 2019 | The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected. | ||
| CVE-2018-14919 | Med | 0.40 | 6.1 | 0.02 | Jun 28, 2019 | LOYTEC LGATE-902 6.3.2 devices allow XSS. | ||
| CVE-2018-6145 | Med | 0.40 | 6.1 | 0.01 | Jun 27, 2019 | Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page. | ||
| CVE-2018-6128 | Med | 0.40 | 6.1 | 0.01 | Jun 27, 2019 | Incorrect URL parsing in WebKit in Google Chrome on iOS prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page. | ||
| CVE-2019-12581 | Med | 0.40 | 6.1 | 0.06 | Jun 27, 2019 | A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter. | ||
| CVE-2019-3961 | Med | 0.40 | 6.1 | 0.01 | Jun 25, 2019 | Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script… | ||
| CVE-2019-4157 | Med | 0.40 | 6.1 | 0.01 | Jun 25, 2019 | IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2019-12964 | Med | 0.40 | 6.1 | 0.01 | Jun 25, 2019 | LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject. | ||
| CVE-2019-12963 | Med | 0.40 | 6.1 | 0.01 | Jun 25, 2019 | LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action. | ||
| CVE-2019-12949 | Med | 0.40 | 6.1 | 0.03 | Jun 25, 2019 | In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a… |
- risk 0.40cvss 6.1epss 0.01
Subrion CMS before 4.1.4 has XSS.
- risk 0.40cvss 6.1epss 0.01
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated MineMeld admin to type malicious input in the MineMeld UI could execute arbitrary JavaScript code in the admin’s browser.
- risk 0.40cvss 6.1epss 0.01
A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert.
- risk 0.40cvss 6.1epss 0.02
XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context…
- risk 0.40cvss 6.1epss 0.01
Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.
- risk 0.40cvss 6.1epss 0.01
A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.Viewfolder.php.
- risk 0.40cvss 6.1epss 0.02
An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX.
- risk 0.40cvss 6.1epss 0.02
An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX.
- risk 0.40cvss 6.1epss 0.02
An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly.
- risk 0.40cvss 6.1epss 0.01
The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected.
- risk 0.40cvss 6.1epss 0.02
LOYTEC LGATE-902 6.3.2 devices allow XSS.
- risk 0.40cvss 6.1epss 0.01
Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
- risk 0.40cvss 6.1epss 0.01
Incorrect URL parsing in WebKit in Google Chrome on iOS prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
- risk 0.40cvss 6.1epss 0.06
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.
- risk 0.40cvss 6.1epss 0.01
Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script…
- risk 0.40cvss 6.1epss 0.01
IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.40cvss 6.1epss 0.01
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject.
- risk 0.40cvss 6.1epss 0.01
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action.
- risk 0.40cvss 6.1epss 0.03
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a…