Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,646)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2013-7370 4Debian OpensuseRedhat+1 more 4Connect Debian LinuxOpenshift+1 more Nov 21, 2024 Dec 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
CVE-2013-6495 1Redhat 2Jboss Enterprise Application Platform Jboss Portal Nov 21, 2024 Dec 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JBossWeb Bayeux has reflected XSS
CVE-2013-4158 3Debian FedoraprojectSmokeping 3Debian Linux FedoraSmokeping Nov 21, 2024 Dec 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
CVE-2019-19719 1Tableau 1Tableau Server Jun 17, 2026 Dec 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
CVE-2019-19708 1Mediawiki 1Visual Editor Jun 17, 2026 Dec 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
CVE-2019-1332 1Microsoft 3Power Bi Report Server Sql Server 2017 Reporting ServicesSql Server 2019 Reporting Services Jun 17, 2026 Dec 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Repor...Show more A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'.Show less
CVE-2019-13741 4Debian FedoraprojectGoogle+1 more 7Chrome Debian LinuxEnterprise Linux Desktop+4 more Jun 17, 2026 Dec 10, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content.
CVE-2019-4663 1Ibm 1Websphere Application Server Jun 17, 2026 Dec 10, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lead...Show more IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245.Show less
CVE-2014-3656 1Redhat 1Jboss Keycloak Nov 21, 2024 Dec 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JBoss KeyCloak: XSS in login-status-iframe.html
CVE-2019-4611 1Ibm 1Planning Analytics Jun 17, 2026 Dec 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentia...Show more IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.Show less
CVE-2019-4428 1Ibm 1Watson Assistant For Ibm Cloud Pak For Data Jun 17, 2026 Dec 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended funct...Show more IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162807.Show less
CVE-2015-3425 1Accentis 1Content Resource Management System Nov 21, 2024 Dec 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary web script or HTML via the ctl00$cph_content$_uig_formState pa...Show more Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary web script or HTML via the ctl00$cph_content$_uig_formState parameter.Show less
CVE-2019-19682 1Nopcommerce 1Nopcommerce Jun 17, 2026 Dec 9, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body...Show more nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.Show less
CVE-2019-19679 1Xpand It 1Xray Test Mangaement Jun 17, 2026 Dec 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue...Show more In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue.Show less
CVE-2019-19678 1Xpand It 1Xray Test Mangaement Jun 17, 2026 Dec 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test Definition field of a new Generic Test issue.
CVE-2019-16772 1Serialize To Js Project 1Serialize To Js Jun 17, 2026 Dec 7, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affec...Show more The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.Show less
CVE-2019-19552 1Sangoma 1Freepbx Jun 17, 2026 Dec 6, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can...Show more In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user (such as an admin) visits the main User Management screen, the XSS payload will render and execute in the context of the victim user's account.Show less
CVE-2019-19551 1Sangoma 1Freepbx Jun 17, 2026 Dec 6, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values...Show more In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not being properly sanitized. If this is done and a user (such as an admin) visits the User Management screen and views that user's profile, the XSS payload will render and execute in the context of the victim user's account.Show less
CVE-2019-19619 1Documize 1Documize Jun 17, 2026 Dec 6, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
CVE-2012-1115 3Debian FedoraprojectLdap Account Manager 3Debian Linux FedoraLdap Account Manager Nov 21, 2024 Dec 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.

Previous 1...180418051806...2433 Next