CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 948 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-4374 | Med | 0.40 | 6.1 | 0.02 | Apr 3, 2019 | A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8. | ||
| CVE-2018-4345 | Med | 0.40 | 6.1 | 0.01 | Apr 3, 2019 | A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. | ||
| CVE-2018-4309 | Med | 0.40 | 6.1 | 0.01 | Apr 3, 2019 | A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. | ||
| CVE-2019-5422 | Med | 0.40 | 6.1 | 0.01 | Apr 3, 2019 | XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server. | ||
| CVE-2018-18035 | Med | 0.40 | 6.1 | 0.01 | Apr 2, 2019 | A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. | ||
| CVE-2019-5888 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2019 | Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977. | ||
| CVE-2019-10646 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2019 | Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded. | ||
| CVE-2018-19201 | Med | 0.40 | 6.1 | 0.01 | Mar 29, 2019 | A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter. | ||
| CVE-2019-0224 | Med | 0.40 | 6.1 | 0.05 | Mar 28, 2019 | In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser. | ||
| CVE-2019-10254 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2019 | In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability. | ||
| CVE-2019-10238 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2019 | Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter. | ||
| CVE-2019-5926 | Med | 0.40 | 6.1 | 0.02 | Mar 27, 2019 | Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-10118 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2019 | Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API. | ||
| CVE-2019-9961 | Med | 0.40 | 6.1 | 0.01 | Mar 26, 2019 | A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter. | ||
| CVE-2017-7340 | Med | 0.40 | 6.1 | 0.01 | Mar 25, 2019 | A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch parameter in the FortiView functionality. | ||
| CVE-2018-12652 | Med | 0.40 | 6.1 | 0.01 | Mar 25, 2019 | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the LeaveEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter. | ||
| CVE-2019-3480 | Med | 0.40 | 6.1 | 0.01 | Mar 25, 2019 | Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7. | ||
| CVE-2019-10016 | Med | 0.40 | 6.1 | 0.01 | Mar 25, 2019 | GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring. | ||
| CVE-2018-20165 | Med | 0.40 | 6.1 | 0.02 | Mar 22, 2019 | Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI. | ||
| CVE-2019-9925 | Med | 0.40 | 6.1 | 0.01 | Mar 22, 2019 | S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter. |
- risk 0.40cvss 6.1epss 0.02
A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
- risk 0.40cvss 6.1epss 0.01
XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
- risk 0.40cvss 6.1epss 0.01
Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977.
- risk 0.40cvss 6.1epss 0.01
Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded.
- risk 0.40cvss 6.1epss 0.01
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter.
- risk 0.40cvss 6.1epss 0.05
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.
- risk 0.40cvss 6.1epss 0.01
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch parameter in the FortiView functionality.
- risk 0.40cvss 6.1epss 0.01
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the LeaveEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter.
- risk 0.40cvss 6.1epss 0.01
Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
- risk 0.40cvss 6.1epss 0.01
GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
- risk 0.40cvss 6.1epss 0.01
S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.