CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 981 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2013-2999 | Med | 0.40 | 6.1 | 0.01 | Jul 9, 2018 | Cross-site scripting (XSS) vulnerability in IBM InfoSphere Data Replication Dashboard 9.7 and 10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 84115. | ||
| CVE-2018-13256 | Med | 0.40 | 6.1 | 0.01 | Jul 9, 2018 | PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter. | ||
| CVE-2018-13433 | Med | 0.40 | 6.1 | 0.01 | Jul 8, 2018 | Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element. | ||
| CVE-2018-13423 | Med | 0.40 | 6.1 | 0.01 | Jul 7, 2018 | admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag. | ||
| CVE-2018-13422 | Med | 0.40 | 6.1 | 0.01 | Jul 7, 2018 | TCExam before 14.1.2 has XSS via an ff_ or xl_ field. | ||
| CVE-2018-1676 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2018 | IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2018-13339 | Med | 0.40 | 6.1 | 0.01 | Jul 5, 2018 | Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035. | ||
| CVE-2018-9997 | Med | 0.40 | 6.1 | 0.02 | Jul 5, 2018 | Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute… | ||
| CVE-2017-11175 | Med | 0.40 | 6.1 | 0.01 | Jul 5, 2018 | In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login. | ||
| CVE-2018-13252 | Med | 0.40 | 6.1 | 0.01 | Jul 5, 2018 | Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page. | ||
| CVE-2018-13136 | Med | 0.40 | 6.1 | 0.01 | Jul 4, 2018 | The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. | ||
| CVE-2018-7636 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2018 | The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs. | ||
| CVE-2018-3747 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2018 | The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript. | ||
| CVE-2018-7786 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2018 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of malicious scripts. | ||
| CVE-2018-13065 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2018 | ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured | ||
| CVE-2018-12255 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2018 | An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field. | ||
| CVE-2018-10076 | Med | 0.40 | 6.1 | 0.01 | Jul 2, 2018 | An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of the Dashboard). | ||
| CVE-2018-10075 | Med | 0.40 | 6.1 | 0.01 | Jul 2, 2018 | Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature. | ||
| CVE-2018-0499 | Med | 0.40 | 6.1 | 0.01 | Jul 2, 2018 | A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). | ||
| CVE-2018-13039 | Med | 0.40 | 6.1 | 0.01 | Jul 1, 2018 | OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS) via the cari parameter, aka an index.php/first?cari= URI. |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in IBM InfoSphere Data Replication Dashboard 9.7 and 10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 84115.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.
- risk 0.40cvss 6.1epss 0.01
Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.
- risk 0.40cvss 6.1epss 0.01
admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
- risk 0.40cvss 6.1epss 0.01
TCExam before 14.1.2 has XSS via an ff_ or xl_ field.
- risk 0.40cvss 6.1epss 0.01
IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.40cvss 6.1epss 0.01
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute…
- risk 0.40cvss 6.1epss 0.01
In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login.
- risk 0.40cvss 6.1epss 0.01
Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page.
- risk 0.40cvss 6.1epss 0.01
The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.
- risk 0.40cvss 6.1epss 0.01
The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs.
- risk 0.40cvss 6.1epss 0.01
The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.
- risk 0.40cvss 6.1epss 0.01
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of malicious scripts.
- risk 0.40cvss 6.1epss 0.01
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of the Dashboard).
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().
- risk 0.40cvss 6.1epss 0.01
OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS) via the cari parameter, aka an index.php/first?cari= URI.