CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 989 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-10686 | Med | 0.40 | 6.1 | 0.01 | May 6, 2018 | An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php. | ||
| CVE-2018-8900 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability. | ||
| CVE-2018-10568 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7. | ||
| CVE-2018-10567 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7. | ||
| CVE-2018-10566 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7. | ||
| CVE-2018-10565 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7. | ||
| CVE-2018-10564 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7. | ||
| CVE-2018-10563 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7). | ||
| CVE-2018-10294 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS. | ||
| CVE-2018-10680 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the… | ||
| CVE-2018-10665 | Med | 0.40 | 6.1 | 0.01 | May 2, 2018 | ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files. | ||
| CVE-2018-10571 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2018 | Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to… | ||
| CVE-2018-0711 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2018 | Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-10547 | Med | 0.40 | 6.1 | 0.03 | Apr 29, 2018 | An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists… | ||
| CVE-2018-1473 | Med | 0.40 | 6.1 | 0.01 | Apr 27, 2018 | IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2017-1724 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2018 | IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2018-9104 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2018 | A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS)… | ||
| CVE-2018-9103 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2018 | A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS)… | ||
| CVE-2018-9101 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2018 | A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS)… | ||
| CVE-2018-10208 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2018 | An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI. |
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php.
- risk 0.40cvss 6.1epss 0.01
The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7.
- risk 0.40cvss 6.1epss 0.01
An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7).
- risk 0.40cvss 6.1epss 0.01
Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS.
- risk 0.40cvss 6.1epss 0.01
Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the…
- risk 0.40cvss 6.1epss 0.01
ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files.
- risk 0.40cvss 6.1epss 0.01
Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.03
An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists…
- risk 0.40cvss 6.1epss 0.01
IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.40cvss 6.1epss 0.01
IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS)…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS)…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS)…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI.