Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,952)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-17876 1Web Feet 1Coaster Cms Nov 21, 2024 Oct 4, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.
CVE-2018-1604 1Ibm 1Rational Quality Manager Nov 21, 2024 Oct 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...Show more IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143794.Show less
CVE-2018-1603 1Ibm 1Rational Quality Manager Nov 21, 2024 Oct 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...Show more IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143793.Show less
CVE-2018-1602 1Ibm 1Rational Quality Manager Nov 21, 2024 Oct 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...Show more IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143792.Show less
CVE-2018-17054 1Progress 1Sitefinity Cms Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parame...Show more Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17053.Show less
CVE-2018-17053 1Progress 1Sitefinity Cms Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parame...Show more Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054.Show less
CVE-2018-16050 1Gitlab 1Gitlab Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.
CVE-2018-1794 1Ibm 1Websphere Application Server Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f...Show more IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148949.Show less
CVE-2018-1793 1Ibm 1Websphere Application Server Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended fu...Show more IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148948.Show less
CVE-2018-17947 1Atmist 1Snazzy Maps Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.
CVE-2018-17946 1Tribulant 1Slideshow Gallery Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
CVE-2018-17886 1Jeesns 1Jeesns Nov 21, 2024 Oct 2, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, as demonstrated by a <svg/onLoad=confirm substring. NOTE: this vulnerability exis...Show more An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, as demonstrated by a <svg/onLoad=confirm substring. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-12429.Show less
CVE-2018-17884 1Gwolle Guestbook Project 1Gwolle Guestbook Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php
CVE-2018-17596 1Zohocorp 1Manageengine Assetexplorer Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter.
CVE-2018-17595 1Fork Cms 1Fork Cms Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI.
CVE-2018-17594 1Airties 1Air 5443v2 Firmware Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 AirTies Air 5443v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
CVE-2018-17593 1Airties 1Air 5453 Firmware Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 AirTies Air 5453 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
CVE-2018-17591 1Airties 1Air 5343v2 Firmware Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 AirTies Air 5343v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
CVE-2018-17590 1Airties 1Air 5442 Firmware Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 AirTies Air 5442 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
CVE-2018-17589 1Airties 1Air 5650 Firmware Nov 21, 2024 Oct 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 AirTies Air 5650 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.

Previous 1...195519561957...2448 Next