← Back
CWE-79

46,168 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,168)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-19766
1Infovista
1Vistaportal
Nov 21, 2024
Dec 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "GroupRessourceAdmin.jsp" has reflected XSS via the ConnPoolName parameter.
CVE-2018-19765
1Infovista
1Vistaportal
Nov 21, 2024
Dec 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "EditCurrentPresentSpace.jsp" has reflected XSS via the ConnPoolName, GroupId, and ParentId parameters.
CVE-2018-19649
1Infovista
1Vistaportal
Nov 21, 2024
Dec 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in InfoVista VistaPortal SE Version 5.1 (build 51029). VPortal/mgtconsole/RolePermissions.jsp has reflected XSS via the ConnPoolName parameter.
CVE-2018-18248
1Icinga
1Icinga Web 2
Nov 21, 2024
Dec 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string.
CVE-2018-18247
1Icinga
1Icinga Web 2
Nov 21, 2024
Dec 17, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.
CVE-2018-18245
2Debian
Nagios
2Debian Linux
Nagios Core
Nov 21, 2024
Dec 17, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.
CVE-2017-18352
1Google
1Rendertron
Nov 21, 2024
Dec 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
CVE-2018-20153
2Debian
Wordpress
2Debian Linux
Wordpress
Nov 21, 2024
Dec 14, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
CVE-2018-20150
2Debian
Wordpress
2Debian Linux
Wordpress
Nov 21, 2024
Dec 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
CVE-2018-20149
2Debian
Wordpress
2Debian Linux
Wordpress
Nov 21, 2024
Dec 14, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without...Show more
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.Show less
CVE-2018-1848
1Ibm
3Business Automation Workflow
Business Process ManagerWebsphere
Nov 21, 2024
Dec 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pote...Show more
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947.Show less
CVE-2018-5411
1Pixar
1Tractor
Jun 17, 2026
Dec 13, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user r...Show more
Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user. An attacker might include Javascript that could execute on an authenticated user's system that could lead to website redirects, session cookie hijacking, social engineering, etc. As this is stored with the information about the node, all other authenticated users with access to this data are also vulnerable.Show less
CVE-2018-19439
1Oracle
1Secure Global Desktop
Nov 21, 2024
Dec 13, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgd...Show more
XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.Show less
CVE-2018-20138
1Readymadeb2bscript
1Entrepreneur B2b Script
Nov 21, 2024
Dec 13, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.
CVE-2018-20137
1Thedaylightstudio
1Fuel Cms
Nov 21, 2024
Dec 13, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.
CVE-2018-20136
1Thedaylightstudio
1Fuel Cms
Nov 21, 2024
Dec 13, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI.
CVE-2018-1817
1Ibm
1Security Guardium
Nov 21, 2024
Dec 13, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cr...Show more
IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150021.Show less
CVE-2018-1815
1Ibm
1Security Access Manager
Nov 21, 2024
Dec 13, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod...Show more
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150019.Show less
CVE-2018-1740
1Ibm
1Security Access Manager
Nov 21, 2024
Dec 13, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering...Show more
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148419.Show less
CVE-2018-1667
1Ibm
1Datapower Gateway
Nov 21, 2024
Dec 13, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows u...Show more
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144893.Show less