Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,093)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-15567 1Cmsuno Project 1Cmsuno Nov 21, 2024 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CMSUno before 1.5.3 has XSS via the title field.
CVE-2018-15566 1Tp5cms Project 1Tp5cms Nov 21, 2024 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter.
CVE-2018-15559 1Xiuno 1Xiunobbs Nov 21, 2024 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The editor in Xiuno BBS 4.0.4 allows stored XSS.
CVE-2018-10139 1Paloaltonetworks 1Pan Os Nov 21, 2024 Aug 16, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or...Show more The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.Show less
CVE-2018-1715 1Ibm 1Maximo Asset Management Nov 21, 2024 Aug 16, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147003.Show less
CVE-2018-0386 1Cisco 2Hosted Collaboration Solution Unified Communications Domain Manager Nov 21, 2024 Aug 15, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to im...Show more A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to improper validation of input that is passed to the affected software. An attacker could exploit this vulnerability by persuading a user of the affected software to access a malicious URL. A successful exploit could allow the attacker to access sensitive, browser-based information on the affected system or perform arbitrary actions in the affected software in the security context of the user. Cisco Bug IDs: CSCvh49694.Show less
CVE-2018-0367 1Cisco 1Registered Envelope Service Nov 21, 2024 Aug 15, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based...Show more A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco Bug IDs: CVE-2018-0367.Show less
CVE-2018-10369 1Intelbras 1Win 240 Firmware Nov 21, 2024 Aug 15, 2018 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A Cross-site scripting (XSS) vulnerability was discovered on Intelbras Win 240 V1.1.0 devices. An attacker can change the Admin Password without a Login.
CVE-2018-14922 1Monstra 1Monstra Nov 21, 2024 Aug 14, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page.
CVE-2018-14888 1Thank You/like Project 1Thank You/like Nov 21, 2024 Aug 14, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject.
CVE-2018-2444 1Sap 1Businessobjects Financial Consolidation Nov 21, 2024 Aug 14, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2018-3781 1Nextcloud 1Talk Nov 21, 2024 Aug 13, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search...Show more A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.Show less
CVE-2018-3780 1Nextcloud 1Nextcloud Server Nov 21, 2024 Aug 13, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious sea...Show more A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.Show less
CVE-2018-14850 1Tiki 1Tikiwiki Cms/groupware Nov 21, 2024 Aug 13, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a mo...Show more Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.Show less
CVE-2018-14849 1Tiki 1Tikiwiki Cms/groupware Nov 21, 2024 Aug 13, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.
CVE-2018-12587 1German Spelling Dictionary Project 1German Spelling Dictionary Nov 21, 2024 Aug 13, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser add-on). Instead of providing text for a spelling check, remote attackers may inject arbitrary web sc...Show more A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser add-on). Instead of providing text for a spelling check, remote attackers may inject arbitrary web script or HTML via the ajax query parameter in the URL Address Bar.Show less
CVE-2018-10569 1Edimax 1Edimax Ew 7438rpn V2 Firmware Nov 21, 2024 Aug 13, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.
CVE-2018-13392 1Atlassian 2Crucible Fisheye Nov 21, 2024 Aug 13, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.
CVE-2018-14784 1Netcommwireless 1Nwl 25 Firmware Nov 21, 2024 Aug 10, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device is vulnerable to several cross-site scripting attacks, allowing a remote attacker to run arbitrary code on the dev...Show more NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device is vulnerable to several cross-site scripting attacks, allowing a remote attacker to run arbitrary code on the device.Show less
CVE-2018-15190 1Hotel Booking Script Project 1Hotel Booking Script Nov 21, 2024 Aug 10, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field.

Previous 1...197519761977...2455 Next