CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 985 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-5458 | Med | 0.40 | 6.1 | 0.01 | Jun 11, 2018 | When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. This vulnerability affects Firefox < 53. | ||
| CVE-2017-5393 | Med | 0.40 | 6.1 | 0.01 | Jun 11, 2018 | The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This… | ||
| CVE-2016-9903 | Med | 0.40 | 6.1 | 0.01 | Jun 11, 2018 | Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox <… | ||
| CVE-2018-12099 | Med | 0.40 | 6.1 | 0.02 | Jun 11, 2018 | Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links. | ||
| CVE-2018-9182 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2018 | Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section. | ||
| CVE-2018-9177 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2018 | Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen. | ||
| CVE-2018-12047 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2018 | xfind/search in Ximdex 4.0 has XSS via the filter[n][value] parameters for non-negative values of n, as demonstrated by n equal to 0 through 12. | ||
| CVE-2018-0357 | Med | 0.40 | 6.1 | 0.02 | Jun 7, 2018 | A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain… | ||
| CVE-2018-0356 | Med | 0.40 | 6.1 | 0.02 | Jun 7, 2018 | A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain… | ||
| CVE-2018-0354 | Med | 0.40 | 6.1 | 0.02 | Jun 7, 2018 | A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of… | ||
| CVE-2018-0339 | Med | 0.40 | 6.1 | 0.02 | Jun 7, 2018 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input… | ||
| CVE-2018-12043 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2018 | content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page. | ||
| CVE-2018-3735 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2018 | bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template | ||
| CVE-2018-11553 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2018 | SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php. | ||
| CVE-2017-7636 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2018 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2016-9490 | Med | 0.40 | 6.1 | 0.02 | Jun 5, 2018 | ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233.… | ||
| CVE-2018-11735 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2018 | index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter. | ||
| CVE-2017-16022 | Med | 0.40 | 6.1 | 0.01 | Jun 4, 2018 | Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that… | ||
| CVE-2017-16019 | Med | 0.40 | 6.1 | 0.01 | Jun 4, 2018 | GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on… | ||
| CVE-2017-16018 | Med | 0.40 | 6.1 | 0.01 | Jun 4, 2018 | Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers. |
- risk 0.40cvss 6.1epss 0.01
When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. This vulnerability affects Firefox < 53.
- risk 0.40cvss 6.1epss 0.01
The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This…
- risk 0.40cvss 6.1epss 0.01
Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox <…
- risk 0.40cvss 6.1epss 0.02
Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.
- risk 0.40cvss 6.1epss 0.01
Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
- risk 0.40cvss 6.1epss 0.01
Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.
- risk 0.40cvss 6.1epss 0.01
xfind/search in Ximdex 4.0 has XSS via the filter[n][value] parameters for non-negative values of n, as demonstrated by n equal to 0 through 12.
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain…
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain…
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of…
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input…
- risk 0.40cvss 6.1epss 0.01
content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.
- risk 0.40cvss 6.1epss 0.01
bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
- risk 0.40cvss 6.1epss 0.01
SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.02
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233.…
- risk 0.40cvss 6.1epss 0.01
index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.
- risk 0.40cvss 6.1epss 0.01
Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that…
- risk 0.40cvss 6.1epss 0.01
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on…
- risk 0.40cvss 6.1epss 0.01
Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers.