9160 matches found
CVE-2022-46870 Apache Zeppelin: Stored XSS in note permissions
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...
GHSA-MCVF-2Q2M-X72M Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
Summary rails-html-sanitizer = 1.0.3, = 2.1.0. Mitigation Upgrade to rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type...
Input validation
Improper neutralization of input during web page generation CWE-79 in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR...
Protect
A improper neutralization of input during web page generation 'cross-site scripting' CWE-79 in FortiOS may allow a privileged attacker to perform a stored XSS attack via storing malicious payloads in replacement messages...
Fortinet FortiADC Cross-Site Scripting Vulnerability (CNVD-2023-02489)
Fortinet FortiADC is an application delivery controller from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiADC, which stems from incorrectly neutralizing input during web page generation. An attacker could exploit this vulnerability to execute client-side code...
Cross site scripting
An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting XSS attack in the taxonomy management feature...
CVE-2022-39950
An improper neutralization of input during web page generation vulnerability CWE-79 exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via...
Cross site scripting
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting XSS attack via configuring a specially crafted IP Address...
CVE-2022-35851
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting XSS attack via configuring a specially crafted IP Address...
Fortinet FortiADC 跨站脚本漏洞
Fortinet FortiADC is an application delivery controller from Fortinet, Inc. A security vulnerability exists in Fortinet FortiADC version 7.1.0 that originates from incorrect neutralization of input during web page generation. An attacker could exploit the vulnerability to execute cross-site...
CVE-2022-35851
FortiADC management interface 7.1.0 is affected by an improper neutralization of input during web page generation (CWE-79) that may allow a remote and authenticated attacker to trigger a stored cross-site scripting (XSS) attack by configuring a specially crafted IP Address. The issue is documente...
FortiADC - Stored XSS vulnerability in external resource page
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiADC management interface may allow a remote and authenticated attacker to trigger a stored cross site scripting XSS attack via configuring a specially crafted IP Address...
CVE-2021-43080
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting XSS attack through the URI parameter via the Threat...
CVE-2022-26114
CVE-2022-26114 affects Fortinet FortiMail Webmail. The issue is an improper neutralization of input during web page generation, enabling cross-site scripting (XSS) via specially crafted mail messages. Affected product: FortiMail Webmail prior to version 7.2.0. Root cause: input handling in web pa...
CVE-2022-23438
An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and prior may allow an unauthenticated remote attacker to perform a reflected cross site scripting XSS attack in the captive portal authenticatio...
CVE-2022-22682
Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
GHSA-C58J-88F5-H53F Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pycares
Impact pycares versions 4.2.0 are affected by CVE-2021-3672. Patches Update to version 4.2.0...
Protect
An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in FortiOS may allow an unauthenticated remote attacker to perform a reflected cross site scripting XSS attack in the captive portal authentication replacement page...
