Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,712)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-14953 1Jetbrains 1Youtrack Jun 17, 2026 Oct 1, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
CVE-2019-4497 1Ibm 1Jazz Reporting Service Jun 17, 2026 Oct 1, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt...Show more IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164118.Show less
CVE-2019-4495 1Ibm 1Jazz Reporting Service Jun 17, 2026 Oct 1, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt...Show more IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164116.Show less
CVE-2019-4494 1Ibm 1Jazz Reporting Service Jun 17, 2026 Oct 1, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt...Show more IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164115.Show less
CVE-2019-14952 1Jetbrains 1Youtrack Jun 17, 2026 Oct 1, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
CVE-2019-10432 1Jenkins 1Html Publisher Jun 17, 2026 Oct 1, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.
CVE-2019-15810 1Netdisco 1Netdisco Jun 17, 2026 Sep 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.
CVE-2019-4115 1Ibm 1Websphere Extreme Scale Jun 17, 2026 Sep 30, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158113.Show less
CVE-2019-4106 1Ibm 1Websphere Extreme Scale Jun 17, 2026 Sep 30, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158099.Show less
CVE-2019-16684 1Xoops 1Xoops Jun 17, 2026 Sep 30, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes.
CVE-2019-16683 1Xoops 1Xoops Jun 17, 2026 Sep 30, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes.
CVE-2019-17045 1Ilch 1Ilch Cms Jun 17, 2026 Sep 30, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.
CVE-2019-16414 1Gfi 1Kerio Control Jun 17, 2026 Sep 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.
CVE-2019-14752 1Salesagility 1Suitecrm Jun 17, 2026 Sep 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.
CVE-2019-16935 3Canonical DebianPython 3Debian Linux PythonUbuntu Linux Oct 7, 2026 Sep 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py i...Show more The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.Show less
CVE-2019-16926 1Flower Project 1Flower Jun 17, 2026 Sep 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal b...Show more Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full accessShow less
CVE-2019-16925 1Flower Project 1Flower Jun 17, 2026 Sep 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. T...Show more Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full accessShow less
CVE-2019-3747 1Dell 1Emc Integrated Data Protection Appliance Firmware Jun 17, 2026 Sep 27, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTM...Show more Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users access the page through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.Show less
CVE-2019-16688 1Dolibarr 1Dolibarr Erp/crm Jun 17, 2026 Sep 27, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to us...Show more Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)Show less
CVE-2019-16687 1Dolibarr 1Dolibarr Erp/crm Jun 17, 2026 Sep 27, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalatio...Show more Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.Show less

Previous 1...183118321833...2436 Next