Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,082)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-0450 1Cisco 1Data Center Network Manager Nov 21, 2024 Oct 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the management i...Show more A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the management interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.Show less
CVE-2018-0444 1Cisco 1Packaged Contact Center Enterprise Nov 21, 2024 Oct 5, 2018 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack against a user of the interface. The vulner...Show more A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.Show less
CVE-2018-1812 1Ibm 1Robotic Process Automation With Automation Anywhere Nov 21, 2024 Oct 5, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a database field. An attacker that has access to the Control Room data...Show more IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a database field. An attacker that has access to the Control Room database could exploit this vulnerability to execute script in a victim's web browser within the security context of the hosting Web site, once victim opens a certain page in Control Room. IBM X-Force ID: 149883.Show less
CVE-2018-1795 1Ibm 1Robotic Process Automation With Automation Anywhere Nov 21, 2024 Oct 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended fun...Show more IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149073.Show less
CVE-2018-1686 1Ibm 1Maximo Asset Management Nov 21, 2024 Oct 5, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145505.Show less
CVE-2018-17849 1Naviwebs 1Navigate Cms Nov 21, 2024 Oct 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload.
CVE-2018-16456 1Phpscriptsmall 1Website Seller Script Nov 21, 2024 Oct 4, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature.
CVE-2018-16455 1Marketplace Script Project 1Marketplace Script Nov 21, 2024 Oct 4, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword.
CVE-2018-16453 1Domain Lookup Script Project 1Domain Lookup Script Nov 21, 2024 Oct 4, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar.
CVE-2018-16326 1Phpscriptsmall 1Olx Clone Nov 21, 2024 Oct 4, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Olx Clone 3.4.2 has XSS.
CVE-2018-17876 1Web Feet 1Coaster Cms Nov 21, 2024 Oct 4, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.
CVE-2018-1604 1Ibm 1Rational Quality Manager Nov 21, 2024 Oct 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...Show more IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143794.Show less
CVE-2018-1603 1Ibm 1Rational Quality Manager Nov 21, 2024 Oct 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...Show more IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143793.Show less
CVE-2018-1602 1Ibm 1Rational Quality Manager Nov 21, 2024 Oct 4, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...Show more IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143792.Show less
CVE-2018-17054 1Progress 1Sitefinity Cms Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parame...Show more Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17053.Show less
CVE-2018-17053 1Progress 1Sitefinity Cms Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parame...Show more Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054.Show less
CVE-2018-16050 1Gitlab 1Gitlab Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.
CVE-2018-1794 1Ibm 1Websphere Application Server Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f...Show more IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148949.Show less
CVE-2018-1793 1Ibm 1Websphere Application Server Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended fu...Show more IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148948.Show less
CVE-2018-17947 1Atmist 1Snazzy Maps Nov 21, 2024 Oct 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.

Previous 1...196119621963...2455 Next