CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 967 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-17904 | Med | 0.40 | 6.1 | 0.01 | Oct 25, 2018 | Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code. | ||
| CVE-2018-18621 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2018 | CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link (in .txt format) is modified and then renamed with a .html or .wssp extension. | ||
| CVE-2018-18551 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2018 | ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type parameter, sensors.html device parameter, report.html location parameter, group_delete.html group parameter, report_save.html query… | ||
| CVE-2018-18636 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2018 | XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter. | ||
| CVE-2018-18635 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2018 | www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO. | ||
| CVE-2018-18547 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2018 | Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dir_a parameter, or the filename to the list/directory/ URI. | ||
| CVE-2018-7427 | Med | 0.40 | 6.1 | 0.01 | Oct 23, 2018 | Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allows remote attackers to inject arbitrary… | ||
| CVE-2018-16235 | Med | 0.40 | 6.1 | 0.01 | Oct 23, 2018 | Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget. | ||
| CVE-2018-16226 | Med | 0.40 | 6.1 | 0.01 | Oct 23, 2018 | A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack, due to insufficient validation for the start.asp page. A successful… | ||
| CVE-2018-12901 | Med | 0.40 | 6.1 | 0.01 | Oct 23, 2018 | A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 (19.49.9400.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit… | ||
| CVE-2018-18622 | Med | 0.40 | 6.1 | 0.01 | Oct 23, 2018 | An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter. | ||
| CVE-2018-18608 | Med | 0.40 | 6.1 | 0.03 | Oct 23, 2018 | DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php,… | ||
| CVE-2018-18579 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2018 | Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter. | ||
| CVE-2018-18578 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2018 | DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter. | ||
| CVE-2018-15703 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2018 | Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is… | ||
| CVE-2018-12246 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2018 | Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack… | ||
| CVE-2018-18553 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2018 | Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page. | ||
| CVE-2018-18545 | Med | 0.40 | 6.1 | 0.01 | Oct 21, 2018 | Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter. | ||
| CVE-2018-18540 | Med | 0.40 | 6.1 | 0.01 | Oct 20, 2018 | TeaKKi 2.7 allows XSS via a crafted onerror attribute for a picture's URL. | ||
| CVE-2018-15315 | Med | 0.40 | 6.1 | 0.01 | Oct 19, 2018 | On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page. |
- risk 0.40cvss 6.1epss 0.01
Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code.
- risk 0.40cvss 6.1epss 0.01
CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link (in .txt format) is modified and then renamed with a .html or .wssp extension.
- risk 0.40cvss 6.1epss 0.01
ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type parameter, sensors.html device parameter, report.html location parameter, group_delete.html group parameter, report_save.html query…
- risk 0.40cvss 6.1epss 0.01
XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter.
- risk 0.40cvss 6.1epss 0.01
www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.
- risk 0.40cvss 6.1epss 0.01
Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dir_a parameter, or the filename to the list/directory/ URI.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allows remote attackers to inject arbitrary…
- risk 0.40cvss 6.1epss 0.01
Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack, due to insufficient validation for the start.asp page. A successful…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 (19.49.9400.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter.
- risk 0.40cvss 6.1epss 0.03
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php,…
- risk 0.40cvss 6.1epss 0.01
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.
- risk 0.40cvss 6.1epss 0.01
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.
- risk 0.40cvss 6.1epss 0.01
Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is…
- risk 0.40cvss 6.1epss 0.01
Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack…
- risk 0.40cvss 6.1epss 0.01
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.
- risk 0.40cvss 6.1epss 0.01
Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.
- risk 0.40cvss 6.1epss 0.01
TeaKKi 2.7 allows XSS via a crafted onerror attribute for a picture's URL.
- risk 0.40cvss 6.1epss 0.01
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page.