Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,093)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-13433 1Boostnote 1Boostnote Nov 21, 2024 Jul 8, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.
CVE-2018-13423 1Omeka 1Omeka Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
CVE-2018-13422 1Tecnick 1Tcexam Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TCExam before 14.1.2 has XSS via an ff_ or xl_ field.
CVE-2018-11351 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each tim...Show more script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could be triggered without authentication, and target the administrator. The attack vectors are the Content-Type field and the filename parameter.Show less
CVE-2018-11350 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scripting vulnerability via the name parameter.
CVE-2018-13409 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
CVE-2018-13408 1Jirafeau 1Jirafeau Nov 21, 2024 Jul 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
CVE-2018-1676 1Ibm 1Planning Analytics Local Nov 21, 2024 Jul 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lead...Show more IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145118.Show less
CVE-2018-1556 1Ibm 2Content Foundation Filenet Content Manager Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142893.Show less
CVE-2018-1555 1Ibm 2Content Foundation Filenet Content Manager Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142892.Show less
CVE-2018-1494 1Ibm 1Rational Doors Next Generation Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...Show more IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141097.Show less
CVE-2018-11124 1Opmantek 1Open Audit Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribut...Show more Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.Show less
CVE-2017-1238 1Ibm 2Rational Collaborative Lifecycle Management Rational Quality Manager Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pote...Show more IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124356.Show less
CVE-2017-1237 1Ibm 7Rational Collaborative Lifecycle Management Rational Doors Next GenerationRational Engineering Lifecycle Manager+4 more Nov 21, 2024 Jul 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent...Show more IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124355.Show less
CVE-2018-13339 1Angular Redactor Project 1Angular Redactor Nov 21, 2024 Jul 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
CVE-2018-9997 1Open Xchange 1Open Xchange Appsuite Jun 17, 2026 Jul 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject...Show more Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets.Show less
CVE-2018-8738 1Airties 25444 Firmware 5444tt Firmware Jun 17, 2026 Jul 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Airties 5444 1.0.0.18 and 5444TT 1.0.0.18 devices allow XSS.
CVE-2018-8046 1Sencha 1Ext Js Jun 17, 2026 Jul 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensur...Show more The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip() method of Action Columns takes HTML-escaped data and un-escapes it. If the tooltip contains user-controlled data, an attacker could exploit this to create a cross-site scripting attack, even when developers took precautions and escaped data.Show less
CVE-2017-11175 1Siemens 1Fin Stack Nov 21, 2024 Jul 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login.
CVE-2018-13252 1Entrustdatacard 1Syntera Customization Suite Nov 21, 2024 Jul 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page.

Previous 1...198519861987...2455 Next