CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 944 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-11812 | Med | 0.40 | 6.1 | 0.01 | May 8, 2019 | A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link. | ||
| CVE-2019-7687 | Med | 0.40 | 6.1 | 0.02 | May 7, 2019 | cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data. | ||
| CVE-2019-7427 | Med | 0.40 | 6.1 | 0.03 | May 7, 2019 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter. | ||
| CVE-2019-7426 | Med | 0.40 | 6.1 | 0.03 | May 7, 2019 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter. | ||
| CVE-2019-11629 | Med | 0.40 | 6.1 | 0.01 | May 7, 2019 | Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS. | ||
| CVE-2018-14478 | Med | 0.40 | 6.1 | 0.01 | May 7, 2019 | ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter. | ||
| CVE-2018-4065 | Med | 0.40 | 6.1 | 0.05 | May 6, 2019 | An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code… | ||
| CVE-2018-13983 | Med | 0.40 | 6.1 | 0.02 | May 6, 2019 | ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php. | ||
| CVE-2019-3400 | Med | 0.40 | 6.1 | 0.01 | May 3, 2019 | The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter. | ||
| CVE-2019-1856 | Med | 0.40 | 6.1 | 0.01 | May 3, 2019 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance (PCA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The… | ||
| CVE-2019-1852 | Med | 0.40 | 6.1 | 0.01 | May 3, 2019 | A vulnerability in the web-based management interface of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of… | ||
| CVE-2018-16960 | Med | 0.40 | 6.1 | 0.01 | May 2, 2019 | An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xd_user_formal_name parameter. | ||
| CVE-2018-16718 | Med | 0.40 | 6.1 | 0.01 | May 2, 2019 | An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument. | ||
| CVE-2018-10383 | Med | 0.40 | 6.1 | 0.02 | May 2, 2019 | Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page. | ||
| CVE-2019-3490 | Med | 0.40 | 6.1 | 0.01 | May 2, 2019 | A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions… | ||
| CVE-2019-11676 | Med | 0.40 | 6.1 | 0.02 | May 2, 2019 | The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. | ||
| CVE-2018-8035 | Med | 0.40 | 6.1 | 0.05 | May 1, 2019 | This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user… | ||
| CVE-2019-3562 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2019 | A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11. | ||
| CVE-2019-11592 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2019 | WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php. | ||
| CVE-2015-9285 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2019 | esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI. |
- risk 0.40cvss 6.1epss 0.01
A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.
- risk 0.40cvss 6.1epss 0.02
cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data.
- risk 0.40cvss 6.1epss 0.03
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter.
- risk 0.40cvss 6.1epss 0.03
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter.
- risk 0.40cvss 6.1epss 0.01
Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.
- risk 0.40cvss 6.1epss 0.01
ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter.
- risk 0.40cvss 6.1epss 0.05
An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code…
- risk 0.40cvss 6.1epss 0.02
ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php.
- risk 0.40cvss 6.1epss 0.01
The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance (PCA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xd_user_formal_name parameter.
- risk 0.40cvss 6.1epss 0.01
An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument.
- risk 0.40cvss 6.1epss 0.02
Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
- risk 0.40cvss 6.1epss 0.01
A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions…
- risk 0.40cvss 6.1epss 0.02
The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks.
- risk 0.40cvss 6.1epss 0.05
This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user…
- risk 0.40cvss 6.1epss 0.01
A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11.
- risk 0.40cvss 6.1epss 0.01
WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php.
- risk 0.40cvss 6.1epss 0.01
esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.