CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 971 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-17884 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2018 | XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php | ||
| CVE-2018-17596 | Med | 0.40 | 6.1 | 0.02 | Oct 2, 2018 | In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. | ||
| CVE-2018-17595 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2018 | In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI. | ||
| CVE-2018-17594 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2018 | AirTies Air 5443v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. | ||
| CVE-2018-17589 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2018 | AirTies Air 5650 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. | ||
| CVE-2018-15563 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2018 | _core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter. | ||
| CVE-2018-17874 | Med | 0.40 | 6.1 | 0.01 | Oct 1, 2018 | ExpressionEngine before 4.3.5 has reflected XSS. | ||
| CVE-2015-9270 | Med | 0.40 | 6.1 | 0.01 | Oct 1, 2018 | XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter. | ||
| CVE-2018-11074 | Med | 0.40 | 6.1 | 0.02 | Sep 28, 2018 | RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim… | ||
| CVE-2018-17571 | Med | 0.40 | 6.1 | 0.01 | Sep 28, 2018 | Vanilla before 2.6.1 allows XSS via the email field of a profile. | ||
| CVE-2018-17056 | Med | 0.40 | 6.1 | 0.01 | Sep 28, 2018 | Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-14037 | Med | 0.40 | 6.1 | 0.01 | Sep 28, 2018 | Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the… | ||
| CVE-2018-1716 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2018 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.… | ||
| CVE-2018-17316 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2018 | On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. | ||
| CVE-2018-17315 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2018 | On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. | ||
| CVE-2018-17314 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2018 | On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. | ||
| CVE-2018-17312 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2018 | On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. | ||
| CVE-2018-17311 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2018 | On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. | ||
| CVE-2018-17309 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2018 | On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. | ||
| CVE-2018-8846 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2018 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is then served to other users. |
- risk 0.40cvss 6.1epss 0.01
XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php
- risk 0.40cvss 6.1epss 0.02
In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter.
- risk 0.40cvss 6.1epss 0.01
In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI.
- risk 0.40cvss 6.1epss 0.01
AirTies Air 5443v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- risk 0.40cvss 6.1epss 0.01
AirTies Air 5650 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
- risk 0.40cvss 6.1epss 0.01
_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.
- risk 0.40cvss 6.1epss 0.01
ExpressionEngine before 4.3.5 has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
- risk 0.40cvss 6.1epss 0.02
RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim…
- risk 0.40cvss 6.1epss 0.01
Vanilla before 2.6.1 allows XSS via the email field of a profile.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the…
- risk 0.40cvss 6.1epss 0.01
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…
- risk 0.40cvss 6.1epss 0.01
On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
- risk 0.40cvss 6.1epss 0.01
On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
- risk 0.40cvss 6.1epss 0.01
On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
- risk 0.40cvss 6.1epss 0.01
On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
- risk 0.40cvss 6.1epss 0.01
On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
- risk 0.40cvss 6.1epss 0.01
On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
- risk 0.40cvss 6.1epss 0.01
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is then served to other users.