Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (45,971)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-14379 1Emc 1Rsa Authentication Manager May 13, 2026 Nov 28, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVE-2017-1689 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134064.Show less
CVE-2017-1688 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134063.Show less
CVE-2017-1678 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten...Show more IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134000.Show less
CVE-2017-1650 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133260.Show less
CVE-2017-1607 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132927.Show less
CVE-2017-1593 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten...Show more IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132494.Show less
CVE-2017-1560 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten...Show more IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131759.Show less
CVE-2017-1461 1Ibm 1Rational Doors Next Generation May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten...Show more IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128460.Show less
CVE-2017-15051 1Teampass 1Teampass May 13, 2026 Nov 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history....Show more Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed.Show less
CVE-2017-15100 2Redhat Theforeman 3Foreman SatelliteSatellite Capsule May 13, 2026 Nov 27, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking...Show more An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.Show less
CVE-2017-8044 1Vmware 1Single Sign On For Pivotal Cloud Foundry May 13, 2026 Nov 27, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks.
CVE-2017-16962 1Communigate 1Communigate Pro May 13, 2026 Nov 27, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calen...Show more The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.Show less
CVE-2017-16956 1Symphony Project 1Symphony May 13, 2026 Nov 27, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title.
CVE-2017-8178 1Huawei 1Vicky Al00 Firmware May 13, 2026 Nov 22, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Huawei Email APP Vicky-AL00 smartphones with software of earlier than VKY-AL00C00B171 versions has a stored cross-site scripting vulnerability. A remote attacker could exploit this vulnerability to send email that storin...Show more Huawei Email APP Vicky-AL00 smartphones with software of earlier than VKY-AL00C00B171 versions has a stored cross-site scripting vulnerability. A remote attacker could exploit this vulnerability to send email that storing malicious code to a smartphone and waiting for a user to access this email that triggers execution of the code. An exploit could allow the attacker to execute arbitrary script code on the affected device.Show less
CVE-2017-8139 1Huawei 1Hedex Lite May 13, 2026 Nov 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 HedEx Earlier than V200R006C00 versions have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services o...Show more HedEx Earlier than V200R006C00 versions have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users.Show less
CVE-2017-8127 1Huawei 1Uma May 13, 2026 Nov 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The UMA product with software V200R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks.
CVE-2017-8125 1Huawei 1Uma May 13, 2026 Nov 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The UMA product with software V200R001 and V300R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks.
CVE-2017-7736 1Fortinet 1Fortiweb May 13, 2026 Nov 22, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certif...Show more A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import.Show less
CVE-2017-16919 1Mapos Project 1Mapos May 13, 2026 Nov 21, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 MapOS 3.1.11 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in /clientes/visualizar, which allows remote attackers to inject arbitrary web script or HTML via a crafted description parameter.

Previous 1...188918901891...2299 Next