CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 965 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-19286 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2018 | The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and then creating and sharing a note. | ||
| CVE-2018-19280 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro. | ||
| CVE-2018-17960 | Med | 0.40 | 6.1 | 0.02 | Nov 14, 2018 | CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. | ||
| CVE-2018-15714 | Med | 0.40 | 6.1 | 0.04 | Nov 14, 2018 | Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters. | ||
| CVE-2018-6081 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page. | ||
| CVE-2018-6076 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page. | ||
| CVE-2018-6070 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. | ||
| CVE-2018-3699 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | Cross-site scripting in the Intel RAID Web Console v3 for Windows may allow an unauthenticated user to elevate privilege via remote access. | ||
| CVE-2018-19190 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter. | ||
| CVE-2018-19189 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement. | ||
| CVE-2018-19188 | Med | 0.40 | 6.1 | 0.02 | Nov 14, 2018 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter. | ||
| CVE-2018-19187 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php echo statement. | ||
| CVE-2018-19186 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2018 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter. | ||
| CVE-2018-8600 | Med | 0.40 | 6.1 | 0.02 | Nov 14, 2018 | A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site Scripting Vulnerability." This affects Azure App. | ||
| CVE-2018-16471 | Med | 0.40 | 6.1 | 0.02 | Nov 13, 2018 | There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value… | ||
| CVE-2018-2479 | Med | 0.40 | 6.1 | 0.01 | Nov 13, 2018 | SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2018-1798 | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2018 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2018-19195 | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2018 | An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\show_product.html file. | ||
| CVE-2018-19193 | Med | 0.40 | 6.1 | 0.01 | Nov 12, 2018 | An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen. | ||
| CVE-2018-19145 | Med | 0.40 | 6.1 | 0.01 | Nov 9, 2018 | An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter. |
- risk 0.40cvss 6.1epss 0.01
The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and then creating and sharing a note.
- risk 0.40cvss 6.1epss 0.01
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
- risk 0.40cvss 6.1epss 0.02
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
- risk 0.40cvss 6.1epss 0.04
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.
- risk 0.40cvss 6.1epss 0.01
XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page.
- risk 0.40cvss 6.1epss 0.01
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.
- risk 0.40cvss 6.1epss 0.01
Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting in the Intel RAID Web Console v3 for Windows may allow an unauthenticated user to elevate privilege via remote access.
- risk 0.40cvss 6.1epss 0.01
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter.
- risk 0.40cvss 6.1epss 0.01
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement.
- risk 0.40cvss 6.1epss 0.02
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter.
- risk 0.40cvss 6.1epss 0.01
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php echo statement.
- risk 0.40cvss 6.1epss 0.01
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter.
- risk 0.40cvss 6.1epss 0.02
A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site Scripting Vulnerability." This affects Azure App.
- risk 0.40cvss 6.1epss 0.02
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value…
- risk 0.40cvss 6.1epss 0.01
SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\show_product.html file.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter.