Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,120)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-1376 1Ibm 1Security Guardium Big Data Intelligence Nov 21, 2024 May 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality po...Show more IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137777.Show less
CVE-2018-11532 1Changuondyu Advanced Statistics Project 1Changuondyu Advanced Statistics Nov 21, 2024 May 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field.
CVE-2018-11430 1Moderator Log Notes Project 1Moderator Log Notes Nov 21, 2024 May 28, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea.
CVE-2018-11512 1Creatiwity 1Witycms Nov 21, 2024 May 28, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HT...Show more Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.Show less
CVE-2018-11501 1Website Seller Script Project 1Website Seller Script Nov 21, 2024 May 26, 2018 N/A· v4 8.8 HIGH· v3 6.0 MEDIUM· v2 PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS.
CVE-2018-11487 1Phpmywind 1Phpmywind Nov 21, 2024 May 26, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.
CVE-2018-11473 1Monstra 1Monstra Nov 21, 2024 May 25, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
CVE-2018-11472 1Monstra 1Monstra Nov 21, 2024 May 25, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).
CVE-2018-11471 1Getcockpit 1Cockpit Nov 21, 2024 May 25, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cockpit 0.5.5 has XSS via a collection, form, or region.
CVE-2017-3961 1Mcafee 1Network Security Manager Nov 21, 2024 May 25, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page...Show more Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes.Show less
CVE-2018-11443 1Easyservice Billing Project 1Easyservice Billing Nov 21, 2024 May 25, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.
CVE-2018-1136 1Moodle 1Moodle Nov 21, 2024 May 25, 2018 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user...Show more An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.Show less
CVE-2018-11415 1Sap 1Internet Transaction Server Nov 21, 2024 May 24, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product.
CVE-2018-11332 1Clippercms 1Clippercms Nov 21, 2024 May 24, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site...Show more Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php file.Show less
CVE-2018-11404 1Domainmod 1Domainmod Nov 21, 2024 May 24, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
CVE-2018-11403 1Domainmod 1Domainmod Nov 21, 2024 May 24, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.
CVE-2018-10428 1Ilias 1Ilias Nov 21, 2024 May 23, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting.
CVE-2018-6495 1Microfocus 3Cms Server Universal CmdbUniversal Cmdb Browser Jun 17, 2026 May 23, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11...Show more Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS).Show less
CVE-2018-10649 1Citrix 1Xenmobile Server Nov 21, 2024 May 23, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
CVE-2018-10095 1Dolibarr 1Dolibarr Nov 21, 2024 May 22, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

Previous 1...199920002001...2456 Next