CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 956 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-7329 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2019 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $_SERVER['PHP_SELF'] insecurely, mishandling any arbitrary input appended to the webroot URL, without any proper filtration, leading to XSS. | ||
| CVE-2019-7328 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2019 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) via /js/frame.js.php because proper filtration is omitted. | ||
| CVE-2019-7327 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2019 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) because proper filtration is omitted. | ||
| CVE-2019-7326 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2019 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in the view console (console.php) because proper filtration is omitted. This relates to the… | ||
| CVE-2019-7325 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2019 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST['PHP_SELF'], without applying any proper filtration. | ||
| CVE-2018-16481 | Med | 0.40 | 6.1 | 0.01 | Feb 1, 2019 | A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering. | ||
| CVE-2018-16480 | Med | 0.40 | 6.1 | 0.01 | Feb 1, 2019 | A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering. | ||
| CVE-2019-7296 | Med | 0.40 | 6.1 | 0.02 | Jan 31, 2019 | typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula. | ||
| CVE-2019-7295 | Med | 0.40 | 6.1 | 0.02 | Jan 31, 2019 | typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula. | ||
| CVE-2018-18940 | Med | 0.40 | 6.1 | 0.01 | Jan 31, 2019 | servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=[XSS] in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to… | ||
| CVE-2019-4040 | Med | 0.40 | 6.1 | 0.01 | Jan 31, 2019 | IBM I 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 156164. | ||
| CVE-2019-7250 | Med | 0.40 | 6.1 | 0.01 | Jan 31, 2019 | An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code (via SCRIPT elements, event handlers,… | ||
| CVE-2019-3911 | Med | 0.40 | 6.1 | 0.04 | Jan 30, 2019 | Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints. | ||
| CVE-2019-1566 | Med | 0.40 | 6.1 | 0.01 | Jan 30, 2019 | The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. | ||
| CVE-2018-12611 | Med | 0.40 | 6.1 | 0.01 | Jan 30, 2019 | OX App Suite 7.8.4 and earlier allows Directory Traversal. | ||
| CVE-2019-7172 | Med | 0.40 | 6.1 | 0.01 | Jan 29, 2019 | A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/admins/my_edit.php. | ||
| CVE-2018-19727 | Med | 0.40 | 6.1 | 0.02 | Jan 28, 2019 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2018-19726 | Med | 0.40 | 6.1 | 0.02 | Jan 28, 2019 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2018-19724 | Med | 0.40 | 6.1 | 0.02 | Jan 28, 2019 | Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2019-6803 | Med | 0.40 | 6.1 | 0.02 | Jan 25, 2019 | typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar. |
- risk 0.40cvss 6.1epss 0.01
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $_SERVER['PHP_SELF'] insecurely, mishandling any arbitrary input appended to the webroot URL, without any proper filtration, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) via /js/frame.js.php because proper filtration is omitted.
- risk 0.40cvss 6.1epss 0.01
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) because proper filtration is omitted.
- risk 0.40cvss 6.1epss 0.01
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in the view console (console.php) because proper filtration is omitted. This relates to the…
- risk 0.40cvss 6.1epss 0.01
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST['PHP_SELF'], without applying any proper filtration.
- risk 0.40cvss 6.1epss 0.01
A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering.
- risk 0.40cvss 6.1epss 0.01
A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.
- risk 0.40cvss 6.1epss 0.02
typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula.
- risk 0.40cvss 6.1epss 0.02
typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula.
- risk 0.40cvss 6.1epss 0.01
servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=[XSS] in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to…
- risk 0.40cvss 6.1epss 0.01
IBM I 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 156164.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code (via SCRIPT elements, event handlers,…
- risk 0.40cvss 6.1epss 0.04
Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.
- risk 0.40cvss 6.1epss 0.01
The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.
- risk 0.40cvss 6.1epss 0.01
OX App Suite 7.8.4 and earlier allows Directory Traversal.
- risk 0.40cvss 6.1epss 0.01
A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/admins/my_edit.php.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.02
typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar.