CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 951 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-6600 | Med | 0.40 | 6.1 | 0.01 | Mar 13, 2019 | In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login… | ||
| CVE-2019-6599 | Med | 0.40 | 6.1 | 0.01 | Mar 13, 2019 | In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site… | ||
| CVE-2019-9738 | Med | 0.40 | 6.1 | 0.01 | Mar 13, 2019 | jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. | ||
| CVE-2019-9737 | Med | 0.40 | 6.1 | 0.01 | Mar 13, 2019 | Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. | ||
| CVE-2019-9736 | Med | 0.40 | 6.1 | 0.01 | Mar 13, 2019 | DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. | ||
| CVE-2019-9725 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2019 | The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting. | ||
| CVE-2019-9558 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2019 | Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe. | ||
| CVE-2019-9557 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2019 | Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe. | ||
| CVE-2019-9714 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2019 | An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS. | ||
| CVE-2019-9712 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2019 | An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS. | ||
| CVE-2019-9711 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2019 | An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS. | ||
| CVE-2019-1702 | Med | 0.40 | 6.1 | 0.01 | Mar 11, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The… | ||
| CVE-2019-9646 | Med | 0.40 | 6.1 | 0.01 | Mar 10, 2019 | The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area." | ||
| CVE-2019-9580 | Med | 0.40 | 6.1 | 0.03 | Mar 9, 2019 | In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS. | ||
| CVE-2019-7661 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting (XSS) vulnerability. | ||
| CVE-2019-7660 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting (XSS) vulnerability, as demonstrated by admin/login.php. | ||
| CVE-2018-17421 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname. | ||
| CVE-2018-17413 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter. | ||
| CVE-2018-16808 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note. | ||
| CVE-2018-16804 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request. |
- risk 0.40cvss 6.1epss 0.01
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login…
- risk 0.40cvss 6.1epss 0.01
In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site…
- risk 0.40cvss 6.1epss 0.01
jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
- risk 0.40cvss 6.1epss 0.01
Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
- risk 0.40cvss 6.1epss 0.01
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
- risk 0.40cvss 6.1epss 0.01
The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting.
- risk 0.40cvss 6.1epss 0.01
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.
- risk 0.40cvss 6.1epss 0.01
Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The…
- risk 0.40cvss 6.1epss 0.01
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."
- risk 0.40cvss 6.1epss 0.03
In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting (XSS) vulnerability, as demonstrated by admin/login.php.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname.
- risk 0.40cvss 6.1epss 0.01
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request.