CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 942 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-12250 | Med | 0.40 | 6.1 | 0.01 | May 21, 2019 | IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the… | ||
| CVE-2019-10078 | Med | 0.40 | 6.1 | 0.05 | May 20, 2019 | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable. | ||
| CVE-2019-10077 | Med | 0.40 | 6.1 | 0.05 | May 20, 2019 | A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. | ||
| CVE-2019-11809 | Med | 0.40 | 6.1 | 0.01 | May 20, 2019 | An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector. | ||
| CVE-2019-5940 | Med | 0.40 | 6.1 | 0.01 | May 17, 2019 | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Scheduler'. | ||
| CVE-2019-5939 | Med | 0.40 | 6.1 | 0.01 | May 17, 2019 | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Portal'. | ||
| CVE-2019-5938 | Med | 0.40 | 6.1 | 0.01 | May 17, 2019 | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Mail'. | ||
| CVE-2019-5929 | Med | 0.40 | 6.1 | 0.01 | May 17, 2019 | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'. | ||
| CVE-2019-5928 | Med | 0.40 | 6.1 | 0.01 | May 17, 2019 | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function. | ||
| CVE-2019-12139 | Med | 0.40 | 6.1 | 0.01 | May 16, 2019 | An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4. | ||
| CVE-2019-11033 | Med | 0.40 | 6.1 | 0.01 | May 16, 2019 | Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring. | ||
| CVE-2016-10719 | Med | 0.40 | 6.1 | 0.01 | May 15, 2019 | TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password. | ||
| CVE-2014-9919 | Med | 0.40 | 6.1 | 0.01 | May 15, 2019 | An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php. | ||
| CVE-2014-9918 | Med | 0.40 | 6.1 | 0.01 | May 15, 2019 | An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php. | ||
| CVE-2014-9917 | Med | 0.40 | 6.1 | 0.01 | May 15, 2019 | An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter. | ||
| CVE-2019-0298 | Med | 0.40 | 6.1 | 0.01 | May 14, 2019 | SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31,… | ||
| CVE-2019-11846 | Med | 0.40 | 6.1 | 0.01 | May 14, 2019 | /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. | ||
| CVE-2019-11845 | Med | 0.40 | 6.1 | 0.01 | May 14, 2019 | An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter. | ||
| CVE-2019-11844 | Med | 0.40 | 6.1 | 0.01 | May 14, 2019 | An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter. | ||
| CVE-2018-16139 | Med | 0.40 | 6.1 | 0.02 | May 13, 2019 | Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/. |
- risk 0.40cvss 6.1epss 0.01
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the…
- risk 0.40cvss 6.1epss 0.05
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
- risk 0.40cvss 6.1epss 0.05
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Scheduler'.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Portal'.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Mail'.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4.
- risk 0.40cvss 6.1epss 0.01
Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring.
- risk 0.40cvss 6.1epss 0.01
TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter.
- risk 0.40cvss 6.1epss 0.01
SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31,…
- risk 0.40cvss 6.1epss 0.01
/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection.
- risk 0.40cvss 6.1epss 0.01
An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
- risk 0.40cvss 6.1epss 0.01
An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/.