CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 991 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-10183 | Med | 0.40 | 6.1 | 0.01 | Apr 17, 2018 | An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php because of a $_SERVER['REQUEST_URI'] echo, as demonstrated by the dir parameter in a file=charsets action. | ||
| CVE-2018-10138 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2018 | The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter. | ||
| CVE-2018-10136 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2018 | iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI. | ||
| CVE-2018-10135 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2018 | iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel. | ||
| CVE-2018-10128 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2018 | An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php. | ||
| CVE-2018-10108 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2018 | D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webinc/js/bsc_sms_inbox.php. | ||
| CVE-2018-10107 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2018 | D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php. | ||
| CVE-2018-10097 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2018 | XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter. | ||
| CVE-2018-6958 | Med | 0.40 | 6.1 | 0.01 | Apr 13, 2018 | VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack. Exploitation of this issue may lead to the compromise of the vRA user's workstation. | ||
| CVE-2018-6870 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2018 | Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature. | ||
| CVE-2018-1483 | Med | 0.40 | 6.1 | 0.01 | Apr 11, 2018 | IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2018-10000 | Med | 0.40 | 6.1 | 0.01 | Apr 11, 2018 | The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event. | ||
| CVE-2018-9985 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2018 | The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator. | ||
| CVE-2017-18100 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2018 | The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters. | ||
| CVE-2018-9928 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2018 | Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter. | ||
| CVE-2018-6182 | Med | 0.40 | 6.1 | 0.01 | Apr 9, 2018 | Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can… | ||
| CVE-2018-9864 | Med | 0.40 | 6.1 | 0.01 | Apr 9, 2018 | The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. | ||
| CVE-2017-18098 | Med | 0.40 | 6.1 | 0.01 | Apr 6, 2018 | The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through various fields. | ||
| CVE-2018-9328 | Med | 0.40 | 6.1 | 0.01 | Apr 5, 2018 | PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php. | ||
| CVE-2018-9244 | Med | 0.40 | 6.1 | 0.01 | Apr 5, 2018 | GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3,… |
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php because of a $_SERVER['REQUEST_URI'] echo, as demonstrated by the dir parameter in a file=charsets action.
- risk 0.40cvss 6.1epss 0.01
The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter.
- risk 0.40cvss 6.1epss 0.01
iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI.
- risk 0.40cvss 6.1epss 0.01
iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php.
- risk 0.40cvss 6.1epss 0.01
D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webinc/js/bsc_sms_inbox.php.
- risk 0.40cvss 6.1epss 0.01
D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter.
- risk 0.40cvss 6.1epss 0.01
VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack. Exploitation of this issue may lead to the compromise of the vRA user's workstation.
- risk 0.40cvss 6.1epss 0.01
Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.
- risk 0.40cvss 6.1epss 0.01
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.40cvss 6.1epss 0.01
The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event.
- risk 0.40cvss 6.1epss 0.01
The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
- risk 0.40cvss 6.1epss 0.01
The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter.
- risk 0.40cvss 6.1epss 0.01
Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can…
- risk 0.40cvss 6.1epss 0.01
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.
- risk 0.40cvss 6.1epss 0.01
The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through various fields.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.
- risk 0.40cvss 6.1epss 0.01
GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3,…