Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,029)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-0534 1Arsenol Project 1Arsenol Nov 21, 2024 Mar 22, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-18094 1Atlassian 2Crucible Fisheye Nov 21, 2024 Mar 22, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross si...Show more Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.Show less
CVE-2018-8899 1Identityserver 1Identityserver4 Jun 17, 2026 Mar 22, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
CVE-2018-8906 1Dsmall Project 1Dsmall Jun 17, 2026 Mar 22, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/address_id/2.html.
CVE-2018-1229 1Pivotal Software 1Spring Batch Admin Nov 21, 2024 Mar 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script th...Show more Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.Show less
CVE-2017-0924 1Gitlab 1Gitlab Nov 21, 2024 Mar 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting.
CVE-2017-0923 1Gitlab 1Gitlab Nov 21, 2024 Mar 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.
CVE-2017-0917 2Debian Gitlab 2Debian Linux Gitlab Nov 21, 2024 Mar 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.
CVE-2018-1347 1Netiq 1Imanager Nov 21, 2024 Mar 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.
CVE-2018-8832 1Enhavo 1Enhavo Jun 17, 2026 Mar 20, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page.
CVE-2015-7460 1Ibm 1Connections Nov 21, 2024 Mar 20, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108356...Show more Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108356.Show less
CVE-2015-7459 1Ibm 1Connections Nov 21, 2024 Mar 20, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108355...Show more Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108355.Show less
CVE-2015-7458 1Ibm 1Connections Nov 21, 2024 Mar 20, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108354...Show more Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108354.Show less
CVE-2014-1665 1Owncloud 1Owncloud Nov 21, 2024 Mar 20, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
CVE-2018-8815 1Alkacon 1Opencms Jun 17, 2026 Mar 20, 2018 N/A· v4 4.6 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image.
CVE-2018-8805 1Yxcms 1Yxcms Jun 17, 2026 Mar 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbook.php or protected\apps\default\view\mobile\extend_guestbook.php in an index.ph...Show more Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbook.php or protected\apps\default\view\mobile\extend_guestbook.php in an index.php?r=default/column/index&col=guestbook request.Show less
CVE-2018-5233 1Getgrav 1Grav Cms Nov 21, 2024 Mar 19, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.
CVE-2014-2297 1Videowhisper 1Videowhisper Live Streaming Integration Nov 21, 2024 Mar 19, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/h...Show more Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.Show less
CVE-2018-8732 1Wampserver 1Wampserver Jun 17, 2026 Mar 19, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual_del parameter.
CVE-2018-6842 1Kentico 1Xperience Jun 17, 2026 Mar 19, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.

Previous 1...186218631864...2302 Next