CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 997 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-0145 | Med | 0.40 | 6.1 | 0.01 | Feb 22, 2018 | A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The… | ||
| CVE-2018-7280 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2018 | The Ninja Forms plugin before 3.2.14 for WordPress has XSS. | ||
| CVE-2013-4891 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2018 | The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an unclosed HTML tag. | ||
| CVE-2018-7278 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2018 | An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP. | ||
| CVE-2018-7277 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2018 | An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP. | ||
| CVE-2018-7265 | Med | 0.40 | 6.1 | 0.01 | Feb 20, 2018 | Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS. | ||
| CVE-2017-16755 | Med | 0.40 | 6.1 | 0.01 | Feb 19, 2018 | An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked. | ||
| CVE-2018-7197 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2018 | An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL. | ||
| CVE-2017-18090 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2018 | Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author. | ||
| CVE-2018-6944 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2018 | core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable. | ||
| CVE-2018-6943 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2018 | core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable. | ||
| CVE-2018-6189 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2018 | F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/latest/vulnerabilityscans/tags/batch resource, aka a "suggested metadata tags for assets" issue. | ||
| CVE-2016-8517 | Med | 0.40 | 6.1 | 0.02 | Feb 15, 2018 | A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found. | ||
| CVE-2018-7057 | Med | 0.40 | 6.1 | 0.01 | Feb 15, 2018 | RoomWizard before 4.4.x allows XSS via the HelpAction.action pageName parameter. | ||
| CVE-2018-2388 | Med | 0.40 | 6.1 | 0.01 | Feb 14, 2018 | Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. | ||
| CVE-2018-2383 | Med | 0.40 | 6.1 | 0.01 | Feb 14, 2018 | Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. | ||
| CVE-2018-2371 | Med | 0.40 | 6.1 | 0.01 | Feb 14, 2018 | The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2018-2364 | Med | 0.40 | 6.1 | 0.01 | Feb 14, 2018 | SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2018-6891 | Med | 0.40 | 6.1 | 0.01 | Feb 11, 2018 | Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js. | ||
| CVE-2018-1000029 | Med | 0.40 | 6.1 | 0.01 | Feb 9, 2018 | mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vulnerability in index view (/) that can result in . This attack appear to be exploitable via Payload delivered via the type, name, and value… |
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The…
- risk 0.40cvss 6.1epss 0.01
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an unclosed HTML tag.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.
- risk 0.40cvss 6.1epss 0.01
Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL.
- risk 0.40cvss 6.1epss 0.01
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.
- risk 0.40cvss 6.1epss 0.01
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
- risk 0.40cvss 6.1epss 0.01
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
- risk 0.40cvss 6.1epss 0.01
F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/latest/vulnerabilityscans/tags/batch resource, aka a "suggested metadata tags for assets" issue.
- risk 0.40cvss 6.1epss 0.02
A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
- risk 0.40cvss 6.1epss 0.01
RoomWizard before 4.4.x allows XSS via the HelpAction.action pageName parameter.
- risk 0.40cvss 6.1epss 0.01
Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.
- risk 0.40cvss 6.1epss 0.01
Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.
- risk 0.40cvss 6.1epss 0.01
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.
- risk 0.40cvss 6.1epss 0.01
mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vulnerability in index view (/) that can result in . This attack appear to be exploitable via Payload delivered via the type, name, and value…