CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 987 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-10939 | Med | 0.40 | 6.1 | 0.01 | May 30, 2018 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group. | ||
| CVE-2018-11562 | Med | 0.40 | 6.1 | 0.01 | May 30, 2018 | An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. | ||
| CVE-2018-11557 | Med | 0.40 | 6.1 | 0.01 | May 30, 2018 | YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter. | ||
| CVE-2018-11027 | Med | 0.40 | 6.1 | 0.01 | May 29, 2018 | A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2017-16010 | — | Med | 0.40 | 6.1 | 0.01 | May 29, 2018 | i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to… | |
| CVE-2018-1376 | Med | 0.40 | 6.1 | 0.01 | May 29, 2018 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2018-11487 | Med | 0.40 | 6.1 | 0.01 | May 26, 2018 | PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php. | ||
| CVE-2018-11473 | Med | 0.40 | 6.1 | 0.02 | May 25, 2018 | Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). | ||
| CVE-2018-11472 | Med | 0.40 | 6.1 | 0.01 | May 25, 2018 | Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php). | ||
| CVE-2018-10649 | Med | 0.40 | 6.1 | 0.01 | May 23, 2018 | There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3. | ||
| CVE-2018-10095 | Med | 0.40 | 6.1 | 0.87 | May 22, 2018 | Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. | ||
| CVE-2018-6378 | Med | 0.40 | 6.1 | 0.01 | May 22, 2018 | In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager. | ||
| CVE-2018-4941 | Med | 0.40 | 6.1 | 0.02 | May 19, 2018 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure. | ||
| CVE-2018-4940 | Med | 0.40 | 6.1 | 0.02 | May 19, 2018 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure. | ||
| CVE-2018-4931 | Med | 0.40 | 6.1 | 0.02 | May 19, 2018 | Adobe Experience Manager versions 6.1 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2018-4930 | Med | 0.40 | 6.1 | 0.02 | May 19, 2018 | Adobe Experience Manager versions 6.3 and earlier have an exploitable Cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2018-4929 | Med | 0.40 | 6.1 | 0.02 | May 19, 2018 | Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2018-11245 | Med | 0.40 | 6.1 | 0.01 | May 18, 2018 | app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes. | ||
| CVE-2018-10307 | Med | 0.40 | 6.1 | 0.01 | May 18, 2018 | error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception. | ||
| CVE-2018-10306 | Med | 0.40 | 6.1 | 0.01 | May 18, 2018 | Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid date. |
- risk 0.40cvss 6.1epss 0.01
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.
- risk 0.40cvss 6.1epss 0.01
YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter.
- risk 0.40cvss 6.1epss 0.01
A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to…
- risk 0.40cvss 6.1epss 0.01
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.40cvss 6.1epss 0.01
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.
- risk 0.40cvss 6.1epss 0.02
Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
- risk 0.40cvss 6.1epss 0.01
Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).
- risk 0.40cvss 6.1epss 0.01
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
- risk 0.40cvss 6.1epss 0.87
Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
- risk 0.40cvss 6.1epss 0.01
In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.
- risk 0.40cvss 6.1epss 0.02
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.
- risk 0.40cvss 6.1epss 0.02
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager versions 6.1 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager versions 6.3 and earlier have an exploitable Cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.01
app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.
- risk 0.40cvss 6.1epss 0.01
error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.
- risk 0.40cvss 6.1epss 0.01
Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid date.