Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,038)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-13388 1Atlassian 2Crucible Fisheye Nov 21, 2024 Jul 10, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
CVE-2018-11450 1Siemens 1Teamcenter Product Lifecycle Management Nov 21, 2024 Jul 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits the login portal through the URL crafted by the attacker, the attacker can insert h...Show more A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits the login portal through the URL crafted by the attacker, the attacker can insert html/javascript and thus alter/rewrite the login portal page. Siemens PLM Software TEAMCENTER V9.1.3 and newer are not affected.Show less
CVE-2018-1000611 1Openconext 1Openconext Engineblock Nov 21, 2024 Jul 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This atta...Show more SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL.Show less
CVE-2013-2999 1Ibm 1Infosphere Data Replication Dashboard Nov 21, 2024 Jul 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in IBM InfoSphere Data Replication Dashboard 9.7 and 10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 84115.
CVE-2018-13256 1Chartered Accountant \ 1 Auditor Website Project Nov 21, 2024 Jul 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.
CVE-2018-13433 1Boostnote 1Boostnote Nov 21, 2024 Jul 8, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.
CVE-2018-13423 1Omeka 1Omeka Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
CVE-2018-13422 1Tecnick 1Tcexam Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TCExam before 14.1.2 has XSS via an ff_ or xl_ field.
CVE-2018-11351 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each tim...Show more script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could be triggered without authentication, and target the administrator. The attack vectors are the Content-Type field and the filename parameter.Show less
CVE-2018-11350 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scripting vulnerability via the name parameter.
CVE-2018-13409 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
CVE-2018-13408 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
CVE-2018-1676 1Ibm 1Planning Analytics Local Nov 21, 2024 Jul 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lead...Show more IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145118.Show less
CVE-2018-1556 1Ibm 2Content Foundation Filenet Content Manager Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142893.Show less
CVE-2018-1555 1Ibm 2Content Foundation Filenet Content Manager Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142892.Show less
CVE-2018-1494 1Ibm 1Rational Doors Next Generation Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...Show more IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141097.Show less
CVE-2018-11124 1Opmantek 1Open Audit Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribut...Show more Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.Show less
CVE-2017-1238 1Ibm 2Rational Collaborative Lifecycle Management Rational Quality Manager Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pote...Show more IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124356.Show less
CVE-2017-1237 1Ibm 7Rational Collaborative Lifecycle Management Rational Doors Next GenerationRational Engineering Lifecycle Manager+4 more Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent...Show more IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124355.Show less
CVE-2018-13339 1Angular Redactor Project 1Angular Redactor Nov 21, 2024 Jul 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.

Previous 1...183218331834...2302 Next