← Back
CWE-79

49,082 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,082)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-11073
2Emc
Rsa
2Authentication Manager
Rsa Authentication Manager
Nov 21, 2024
Sep 28, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store ar...Show more
RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.Show less
CVE-2018-15365
1Trendmicro
1Deep Discovery Inspector
Nov 21, 2024
Sep 28, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker...Show more
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.Show less
CVE-2018-17574
1Ymfe
1Yapi
Nov 21, 2024
Sep 28, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
CVE-2018-17571
1Vanillaforums
1Vanilla
Nov 21, 2024
Sep 28, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Vanilla before 2.6.1 allows XSS via the email field of a profile.
CVE-2018-17056
1Progress
1Sitefinity Cms
Nov 21, 2024
Sep 28, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-16277
1Xwiki
1Xwiki
Nov 21, 2024
Sep 28, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Image Import function in XWiki through 10.7 has XSS.
CVE-2018-14037
1Progress
1Kendo Ui
Nov 21, 2024
Sep 28, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml...Show more
Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (in the worst case) to take over user sessions.Show less
CVE-2018-1820
1Ibm
1Websphere Portal
Nov 21, 2024
Sep 27, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more
IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150096.Show less
CVE-2018-1716
1Ibm
1Websphere Portal
Nov 21, 2024
Sep 27, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147164.Show less
CVE-2018-1660
1Ibm
1Websphere Portal
Nov 21, 2024
Sep 27, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 144886.Show less
CVE-2018-17316
1Ricoh
1Mp C6003 Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17315
1Ricoh
1Mp C2003sp Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17314
1Ricoh
1Mp 305+ Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17313
1Ricoh
1Mp C307 Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH MP C307 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17312
1Ricoh
1Aficio Mp 301spf Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17311
1Ricoh
1Mp C6503 Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17310
1Ricoh
1Mp C1803 Jpn Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17309
1Ricoh
1Mp C406zspf Firmware
Nov 21, 2024
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVE-2018-17556
1Modx
1Modx Revolution
Nov 21, 2024
Sep 26, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.
CVE-2018-8846
1Philips
1E Alert Firmware
Jun 17, 2026
Sep 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is then...Show more
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is then served to other users.Show less