Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,809)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-16624 1Getkirby 1Kirby Nov 21, 2024 May 13, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
CVE-2018-16623 1Getkirby 1Kirby Nov 21, 2024 May 13, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
CVE-2018-15530 1Xerox 1Colorqube 8580 Firmware Nov 21, 2024 May 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code.
CVE-2018-14710 1Asus 1Rt Ac3200 Firmware Nov 21, 2024 May 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL parameter.
CVE-2018-12304 1Seagate 1Nas Os Nov 21, 2024 May 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Web...Show more Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Website URL.Show less
CVE-2018-12303 1Seagate 1Nas Os Nov 21, 2024 May 13, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names.
CVE-2018-12302 1Seagate 1Nas Os Nov 21, 2024 May 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting.
CVE-2018-12299 1Seagate 1Nas Os Nov 21, 2024 May 13, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names.
CVE-2018-12297 1Seagate 1Nas Os Nov 21, 2024 May 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names.
CVE-2018-20838 1Magazine3 1Amp For Wp Nov 21, 2024 May 13, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.
CVE-2018-7064 2Arubanetworks Siemens 2Aruba Instant Scalance W1750d Firmware Jun 17, 2026 May 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could t...Show more A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0Show less
CVE-2019-4204 1Ibm 2Business Automation Workflow Business Process Manager Jun 17, 2026 May 10, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...Show more IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125.Show less
CVE-2017-12885 1Open Xchange 1Open Xchange Appsuite Nov 21, 2024 May 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVE-2019-11871 1Custom Field Suite Project 1Custom Field Suite Jun 17, 2026 May 10, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.
CVE-2019-11870 1S9y 1Serendipity Jun 17, 2026 May 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.
CVE-2019-11869 1Yuzopro 1Yuzo Jun 17, 2026 May 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin pag...Show more The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.Show less
CVE-2018-20837 1Typesettercms 1Typesetter Nov 21, 2024 May 9, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
CVE-2019-1568 1Paloaltonetworks 1Demisto Jun 17, 2026 May 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Palo Alto Networks Demisto 4.5 build 40249 may allow an unauthenticated attacker to run arbitrary JavaScript or HTML.
CVE-2017-12788 1Metinfo 1Metinfo Nov 21, 2024 May 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1 parameter or the (2) anyid parameter.
CVE-2019-11406 1Intelliants 1Subrion Cms Jun 17, 2026 May 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.

Previous 1...189218931894...2441 Next