CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 964 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-13310 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2018 | Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username. | ||
| CVE-2018-13309 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2018 | Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password. | ||
| CVE-2018-13308 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2018 | Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field. | ||
| CVE-2018-19564 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2018 | Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting. | ||
| CVE-2018-19547 | Med | 0.40 | 6.1 | 0.01 | Nov 26, 2018 | JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter. | ||
| CVE-2018-19469 | Med | 0.40 | 6.1 | 0.01 | Nov 23, 2018 | ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter. | ||
| CVE-2018-19433 | Med | 0.40 | 6.1 | 0.01 | Nov 22, 2018 | ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value. | ||
| CVE-2018-18716 | Med | 0.40 | 6.1 | 0.03 | Nov 20, 2018 | Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. | ||
| CVE-2018-18715 | Med | 0.40 | 6.1 | 0.03 | Nov 20, 2018 | Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. | ||
| CVE-2018-19340 | Med | 0.40 | 6.1 | 0.01 | Nov 17, 2018 | Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter. | ||
| CVE-2018-19301 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log. | ||
| CVE-2018-16619 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | Sonatype Nexus Repository Manager before 3.14 allows XSS. | ||
| CVE-2018-14935 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS. | ||
| CVE-2018-1643 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2018-0699 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-0697 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-0695 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-0687 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-12480 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3. | ||
| CVE-2018-19288 | Med | 0.40 | 6.1 | 0.02 | Nov 15, 2018 | Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.
- risk 0.40cvss 6.1epss 0.01
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.
- risk 0.40cvss 6.1epss 0.01
ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter.
- risk 0.40cvss 6.1epss 0.01
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.
- risk 0.40cvss 6.1epss 0.03
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
- risk 0.40cvss 6.1epss 0.03
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
- risk 0.40cvss 6.1epss 0.01
Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter.
- risk 0.40cvss 6.1epss 0.01
tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.
- risk 0.40cvss 6.1epss 0.01
Sonatype Nexus Repository Manager before 3.14 allows XSS.
- risk 0.40cvss 6.1epss 0.01
The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.
- risk 0.40cvss 6.1epss 0.01
The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.
- risk 0.40cvss 6.1epss 0.02
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.