Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (45,950)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-12677 1Identityserver 1Identityserver3 May 13, 2026 Aug 8, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorizat...Show more IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.Show less
CVE-2017-12655 1Nexusphp Project 1Nexusphp May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.
CVE-2016-3113 1Redhat 1Ovirt Engine May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.
CVE-2009-5145 1Zope 1Zope May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.
CVE-2017-12649 1Liferay 1Liferay Portal May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.
CVE-2017-12648 1Liferay 1Liferay Portal May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
CVE-2017-12647 1Liferay 1Liferay Portal May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.
CVE-2017-12646 1Liferay 1Liferay Portal May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
CVE-2017-12645 1Liferay 1Liferay Portal May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.
CVE-2016-10404 1Liferay 1Liferay Portal May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.
CVE-2017-6769 1Cisco 1Secure Access Control System May 13, 2026 Aug 7, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of...Show more A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCve70587. Known Affected Releases: 5.8(0.8) 5.8(1.5).Show less
CVE-2017-6765 1Cisco 1Adaptive Security Appliance Software May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack again...Show more A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device, aka WebVPN XSS. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve19179.Show less
CVE-2017-6764 1Cisco 1Adaptive Security Appliance Software May 13, 2026 Aug 7, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the w...Show more A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd82064.Show less
CVE-2017-6762 1Cisco 1Jabber Guest May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a us...Show more A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve09718.Show less
CVE-2017-6761 1Cisco 1Finesse May 13, 2026 Aug 7, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based ma...Show more A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd96744.Show less
CVE-2017-12583 1Dokuwiki 1Dokuwiki May 13, 2026 Aug 6, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.
CVE-2017-12572 1Splunk 1Splunk May 13, 2026 Aug 5, 2017 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-1...Show more Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.Show less
CVE-2017-1331 1Ibm 1Content Navigator May 13, 2026 Aug 4, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading t...Show more IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126233.Show less
CVE-2017-12413 1Axis 12100 Network Camera Firmware May 13, 2026 Aug 4, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.
CVE-2017-1327 1Ibm 1Inotes May 13, 2026 Aug 3, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials d...Show more IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.Show less

Previous 1...191219131914...2298 Next