CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 966 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-19137 | Med | 0.40 | 6.1 | 0.03 | Nov 9, 2018 | DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter. | ||
| CVE-2018-19131 | Med | 0.40 | 6.1 | 0.03 | Nov 9, 2018 | Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. | ||
| CVE-2018-19092 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2018 | An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie. | ||
| CVE-2018-19083 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2018 | WeCenter 3.2.0 through 3.2.2 has XSS in the views/default/question/index.tpl.html htmlspecialchars_decode function via the /?/publish/ajax/publish_question/ question_content parameter. | ||
| CVE-2018-19080 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2018 | An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS. | ||
| CVE-2018-19057 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2018 | SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element. | ||
| CVE-2018-19056 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2018 | pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element. | ||
| CVE-2018-19051 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2018 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. | ||
| CVE-2018-19050 | Med | 0.40 | 6.1 | 0.01 | Nov 7, 2018 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter. | ||
| CVE-2018-16474 | Med | 0.40 | 6.1 | 0.01 | Nov 6, 2018 | A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript. | ||
| CVE-2018-18909 | Med | 0.40 | 6.1 | 0.01 | Nov 3, 2018 | xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view. | ||
| CVE-2018-6906 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2018 | A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to inject arbitrary JavaScript via the REST API. | ||
| CVE-2016-6343 | Med | 0.40 | 6.1 | 0.02 | Oct 31, 2018 | JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation… | ||
| CVE-2018-18868 | Med | 0.40 | 6.1 | 0.01 | Oct 31, 2018 | No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the VG48Z5PqVWname parameter. | ||
| CVE-2018-18825 | Med | 0.40 | 6.1 | 0.01 | Oct 30, 2018 | Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log. | ||
| CVE-2018-1767 | Med | 0.40 | 6.1 | 0.01 | Oct 29, 2018 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure… | ||
| CVE-2018-18783 | Med | 0.40 | 6.1 | 0.01 | Oct 29, 2018 | XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter. | ||
| CVE-2018-18782 | Med | 0.40 | 6.1 | 0.01 | Oct 29, 2018 | Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter. | ||
| CVE-2018-18781 | Med | 0.40 | 6.1 | 0.01 | Oct 29, 2018 | DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter. | ||
| CVE-2018-18660 | Med | 0.40 | 6.1 | 0.01 | Oct 26, 2018 | An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue. |
- risk 0.40cvss 6.1epss 0.03
DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.
- risk 0.40cvss 6.1epss 0.03
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie.
- risk 0.40cvss 6.1epss 0.01
WeCenter 3.2.0 through 3.2.2 has XSS in the views/default/question/index.tpl.html htmlspecialchars_decode function via the /?/publish/ajax/publish_question/ question_content parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS.
- risk 0.40cvss 6.1epss 0.01
SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
- risk 0.40cvss 6.1epss 0.01
pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.
- risk 0.40cvss 6.1epss 0.01
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.
- risk 0.40cvss 6.1epss 0.01
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.
- risk 0.40cvss 6.1epss 0.01
A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.
- risk 0.40cvss 6.1epss 0.01
xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view.
- risk 0.40cvss 6.1epss 0.01
A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to inject arbitrary JavaScript via the REST API.
- risk 0.40cvss 6.1epss 0.02
JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation…
- risk 0.40cvss 6.1epss 0.01
No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the VG48Z5PqVWname parameter.
- risk 0.40cvss 6.1epss 0.01
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log.
- risk 0.40cvss 6.1epss 0.01
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…
- risk 0.40cvss 6.1epss 0.01
XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter.
- risk 0.40cvss 6.1epss 0.01
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
- risk 0.40cvss 6.1epss 0.01
DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue.