CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 99 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-6333 | Hig | 0.49 | 7.5 | 0.00 | Dec 7, 2023 | The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session. | ||
| CVE-2023-41789 | Hig | 0.49 | 7.6 | 0.00 | Nov 23, 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials.… | ||
| CVE-2023-36007 | Hig | 0.49 | 7.6 | 0.01 | Nov 14, 2023 | Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability | ||
| CVE-2023-36410 | Hig | 0.49 | 7.6 | 0.01 | Nov 14, 2023 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | ||
| CVE-2023-36031 | Hig | 0.49 | 7.6 | 0.01 | Nov 14, 2023 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | ||
| CVE-2023-26577 | Hig | 0.49 | 7.5 | 0.00 | Oct 25, 2023 | Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user. | ||
| CVE-2023-1356 | Hig | 0.49 | 7.5 | 0.00 | Oct 25, 2023 | Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session by attackers who have convinced the said user to click on a malicious link. | ||
| CVE-2023-41843 | Hig | 0.49 | 7.5 | 0.01 | Oct 13, 2023 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions,… | ||
| CVE-2023-41681 | Hig | 0.49 | 7.5 | 0.00 | Oct 13, 2023 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions,… | ||
| CVE-2023-41680 | Hig | 0.49 | 7.5 | 0.01 | Oct 13, 2023 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions,… | ||
| CVE-2023-32721 | Hig | 0.49 | 7.6 | 0.01 | Oct 12, 2023 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. | ||
| CVE-2023-38164 | Hig | 0.49 | 7.6 | 0.01 | Sep 12, 2023 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | ||
| CVE-2023-36886 | Hig | 0.49 | 7.6 | 0.01 | Sep 12, 2023 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | ||
| CVE-2023-36800 | Hig | 0.49 | 7.6 | 0.01 | Sep 12, 2023 | Dynamics Finance and Operations Cross-site Scripting Vulnerability | ||
| CVE-2023-40577 | Hig | 0.49 | 7.5 | 0.01 | Aug 25, 2023 | Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue… | ||
| CVE-2023-39437 | Hig | 0.49 | 7.6 | 0.00 | Aug 8, 2023 | SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to Cross-site scripting. This could lead to harmful action affecting the Confidentiality, Integrity… | ||
| CVE-2023-38138 | Hig | 0.49 | 7.5 | 0.00 | Aug 2, 2023 | A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical… | ||
| CVE-2021-37386 | Hig | 0.49 | 7.5 | 0.01 | Jul 17, 2023 | Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via the serial number update function. | ||
| CVE-2023-28598 | Hig | 0.49 | 7.5 | 0.01 | Jun 13, 2023 | Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash. | ||
| CVE-2023-21516 | Hig | 0.49 | 7.5 | 0.01 | May 26, 2023 | XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. |
- risk 0.49cvss 7.5epss 0.00
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session.
- risk 0.49cvss 7.6epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials.…
- risk 0.49cvss 7.6epss 0.01
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
- risk 0.49cvss 7.6epss 0.01
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
- risk 0.49cvss 7.6epss 0.01
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
- risk 0.49cvss 7.5epss 0.00
Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user.
- risk 0.49cvss 7.5epss 0.00
Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session by attackers who have convinced the said user to click on a malicious link.
- risk 0.49cvss 7.5epss 0.01
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions,…
- risk 0.49cvss 7.5epss 0.00
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions,…
- risk 0.49cvss 7.5epss 0.01
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions,…
- risk 0.49cvss 7.6epss 0.01
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
- risk 0.49cvss 7.6epss 0.01
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
- risk 0.49cvss 7.6epss 0.01
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
- risk 0.49cvss 7.6epss 0.01
Dynamics Finance and Operations Cross-site Scripting Vulnerability
- risk 0.49cvss 7.5epss 0.01
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue…
- risk 0.49cvss 7.6epss 0.00
SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to Cross-site scripting. This could lead to harmful action affecting the Confidentiality, Integrity…
- risk 0.49cvss 7.5epss 0.00
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical…
- risk 0.49cvss 7.5epss 0.01
Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via the serial number update function.
- risk 0.49cvss 7.5epss 0.01
Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.
- risk 0.49cvss 7.5epss 0.01
XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.