Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,263)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-0872 1Microsoft 2Azure Devops Server Team Foundation Server Jun 17, 2026 May 16, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting...Show more A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0979.Show less
CVE-2019-12139 1Ez 2Ezplatform Admin Ui Ezplatform Page Builder Jun 17, 2026 May 16, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4.
CVE-2019-11033 1Applaudsolutions 1Applaud Hcm Jun 17, 2026 May 16, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring.
CVE-2018-1975 1Ibm 1Rational Doors Web Access Nov 21, 2024 May 16, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the inten...Show more IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153916.Show less
CVE-2019-12136 1Boostio 1Boostnote Jun 17, 2026 May 16, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element.
CVE-2019-10111 1Gitlab 1Gitlab Jun 17, 2026 May 15, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page.
CVE-2019-1733 1Cisco 1Nx Os Jun 17, 2026 May 15, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the NX API (NX-API) Sandbox interface for Cisco NX-OS Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the NX-API Sandbox interfac...Show more A vulnerability in the NX API (NX-API) Sandbox interface for Cisco NX-OS Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the NX-API Sandbox interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the NX-API Sandbox interface. An attacker could exploit this vulnerability by persuading a user of the NX-API Sandbox interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected NX-API Sandbox interface.Show less
CVE-2019-3602 1Mcafee 1Network Security Manager Jun 17, 2026 May 15, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom...Show more Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML.Show less
CVE-2016-10719 1Tp Link 1Archer Cr700 Firmware Nov 21, 2024 May 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded...Show more TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password.Show less
CVE-2014-9919 1Bilboplanet 1Bilboplanet Nov 21, 2024 May 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php.
CVE-2014-9918 1Bilboplanet 1Bilboplanet Nov 21, 2024 May 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php.
CVE-2014-9917 1Bilboplanet 1Bilboplanet Nov 21, 2024 May 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter.
CVE-2019-0298 1Sap 1E Commerce Jun 17, 2026 May 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SH...Show more SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.Show less
CVE-2019-6577 1Siemens 12Simatic Hmi Comfort Outdoor Panels Firmware Simatic Hmi Comfort Panels FirmwareSimatic Hmi Ktp Mobile Panels Ktp400f Firmware+9 more Jun 17, 2026 May 14, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP40...Show more A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify particular parts of the device configuration via SNMP. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires system privileges and user interaction. An attacker could use the vulnerability to compromise confidentiality and the integrity of the affected system. At the stage of publishing this security advisory no public exploitation is known.Show less
CVE-2019-11205 1Tibco 2Spotfire Analytics Platform For Aws Spotfire Server Jun 17, 2026 May 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) at...Show more The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0.Show less
CVE-2019-11846 1Dotcms 1Dotcms Jun 17, 2026 May 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection.
CVE-2019-11845 1Ricoh 1Sp 4510dn Firmware Jun 17, 2026 May 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
CVE-2019-11844 1Ricoh 1Sp 4520dn Firmware Jun 17, 2026 May 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter.
CVE-2019-8391 1Qdpm 1Qdpm Jun 17, 2026 May 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
CVE-2019-8390 1Qdpm 1Qdpm Jun 17, 2026 May 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.

Previous 1...176317641765...2314 Next