CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 945 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-11533 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2019 | Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-5124 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2019 | Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1. | ||
| CVE-2019-11543 | Med | 0.40 | 6.1 | 0.03 | Apr 26, 2019 | XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1. | ||
| CVE-2018-18643 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2019 | GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS. | ||
| CVE-2018-16220 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2019 | Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker (local or remote) to inject JavaScript into the web interface of the device by manipulating the phone book entries or… | ||
| CVE-2019-9669 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2019 | The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but… | ||
| CVE-2019-11511 | Med | 0.40 | 6.1 | 0.02 | Apr 25, 2019 | Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API. | ||
| CVE-2019-11203 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2019 | The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and… | ||
| CVE-2019-7211 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2019 | SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment. | ||
| CVE-2019-11032 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2019 | In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS) injection in multiple locations. | ||
| CVE-2019-10864 | Med | 0.40 | 6.1 | 0.01 | Apr 23, 2019 | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request. | ||
| CVE-2018-1328 | Med | 0.40 | 6.1 | 0.06 | Apr 23, 2019 | Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph". | ||
| CVE-2019-0218 | Med | 0.40 | 6.1 | 0.05 | Apr 22, 2019 | A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface. | ||
| CVE-2019-10241 | Med | 0.40 | 6.1 | 0.09 | Apr 22, 2019 | In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory… | ||
| CVE-2019-11449 | Med | 0.40 | 6.1 | 0.01 | Apr 22, 2019 | I, Librarian 4.10 has XSS via the notes.php notes parameter. | ||
| CVE-2019-11428 | Med | 0.40 | 6.1 | 0.01 | Apr 22, 2019 | I, Librarian 4.10 has XSS via the export.php export_files parameter. | ||
| CVE-2019-11427 | Med | 0.40 | 6.1 | 0.01 | Apr 22, 2019 | An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter. | ||
| CVE-2019-11426 | Med | 0.40 | 6.1 | 0.01 | Apr 22, 2019 | An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter. | ||
| CVE-2019-11359 | Med | 0.40 | 6.1 | 0.01 | Apr 20, 2019 | Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter. | ||
| CVE-2019-9841 | Med | 0.40 | 6.1 | 0.01 | Apr 19, 2019 | Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL. |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.
- risk 0.40cvss 6.1epss 0.03
XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.
- risk 0.40cvss 6.1epss 0.01
GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker (local or remote) to inject JavaScript into the web interface of the device by manipulating the phone book entries or…
- risk 0.40cvss 6.1epss 0.01
The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but…
- risk 0.40cvss 6.1epss 0.02
Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
- risk 0.40cvss 6.1epss 0.01
The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and…
- risk 0.40cvss 6.1epss 0.01
SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment.
- risk 0.40cvss 6.1epss 0.01
In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS) injection in multiple locations.
- risk 0.40cvss 6.1epss 0.01
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
- risk 0.40cvss 6.1epss 0.06
Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph".
- risk 0.40cvss 6.1epss 0.05
A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.
- risk 0.40cvss 6.1epss 0.09
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory…
- risk 0.40cvss 6.1epss 0.01
I, Librarian 4.10 has XSS via the notes.php notes parameter.
- risk 0.40cvss 6.1epss 0.01
I, Librarian 4.10 has XSS via the export.php export_files parameter.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter.
- risk 0.40cvss 6.1epss 0.01
Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.