CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 940 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-12774 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2019 | A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the… | ||
| CVE-2018-5798 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2019 | This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager. | ||
| CVE-2019-3578 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2019 | MyBB 1.8.19 has XSS in the resetpassword function. | ||
| CVE-2018-8047 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2019 | vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via… | ||
| CVE-2019-7554 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2019 | An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2 parameter. | ||
| CVE-2019-7220 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2019 | X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter. | ||
| CVE-2019-1870 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2019 | A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The… | ||
| CVE-2019-5588 | Med | 0.40 | 6.1 | 0.01 | Jun 4, 2019 | A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests. | ||
| CVE-2019-5586 | Med | 0.40 | 6.1 | 0.01 | Jun 4, 2019 | A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests. | ||
| CVE-2019-9839 | Med | 0.40 | 6.1 | 0.01 | Jun 3, 2019 | VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter. | ||
| CVE-2019-9838 | Med | 0.40 | 6.1 | 0.01 | Jun 3, 2019 | VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering. | ||
| CVE-2017-14850 | Med | 0.40 | 6.1 | 0.02 | Jun 3, 2019 | All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to improper external user-input validation. An attacker with access to the web interface is able to hijack sessions or navigate victims outside… | ||
| CVE-2019-12584 | Med | 0.40 | 6.1 | 0.03 | Jun 3, 2019 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. | ||
| CVE-2019-12507 | Med | 0.40 | 6.1 | 0.01 | May 31, 2019 | An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter. | ||
| CVE-2015-7609 | Med | 0.40 | 6.1 | 0.01 | May 30, 2019 | Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra. | ||
| CVE-2015-2230 | Med | 0.40 | 6.1 | 0.01 | May 30, 2019 | Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console. | ||
| CVE-2018-18631 | Med | 0.40 | 6.1 | 0.01 | May 29, 2019 | mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS. | ||
| CVE-2019-7129 | Med | 0.40 | 6.1 | 0.02 | May 29, 2019 | Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2019-4137 | Med | 0.40 | 6.1 | 0.01 | May 29, 2019 | IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2019-0221 | Med | 0.40 | 6.1 | 0.59 | May 28, 2019 | The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be… |
- risk 0.40cvss 6.1epss 0.01
A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the…
- risk 0.40cvss 6.1epss 0.01
This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.
- risk 0.40cvss 6.1epss 0.01
MyBB 1.8.19 has XSS in the resetpassword function.
- risk 0.40cvss 6.1epss 0.01
vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2 parameter.
- risk 0.40cvss 6.1epss 0.01
X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The…
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests.
- risk 0.40cvss 6.1epss 0.01
VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.
- risk 0.40cvss 6.1epss 0.01
VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.
- risk 0.40cvss 6.1epss 0.02
All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to improper external user-input validation. An attacker with access to the web interface is able to hijack sessions or navigate victims outside…
- risk 0.40cvss 6.1epss 0.03
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.
- risk 0.40cvss 6.1epss 0.01
An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter.
- risk 0.40cvss 6.1epss 0.01
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
- risk 0.40cvss 6.1epss 0.01
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
- risk 0.40cvss 6.1epss 0.01
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.01
IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.40cvss 6.1epss 0.59
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be…