PT-2023-30629

Name of the Vulnerable Software and Affected Versions Jannis Thuemmig Email Encoder plugin versions prior to 2.1.9 Description The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations For versions prior to 2.1.9,...

PT-2023-30597

Name of the Vulnerable Software and Affected Versions Russell Jamieson Footer Putter plugin versions 1.17 and earlier Description The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations For Russell Jamieson Foote...

PT-2023-30618

Name of the Vulnerable Software and Affected Versions Christina Uechi Add Widgets to Page plugin versions = 1.3.2 Description The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations For Christina Uechi Add Widget...

ROS-20231116-01

A vulnerability in the RoundCube email client is related to improper input neutralization during the creation of a of a web page. Exploitation of the vulnerability could allow an attacker acting remotely to conduct a cross-site scripted attack. cross-site scripting attacks...

CVE-2023-5987

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected...

Design/Logic Flaw

A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browser when an attacker with admin privileges has modified system values...

VulnCheck KEV: CVE-2021-21087

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

CVE-2023-29044: Improper Neutralization of Input During Web Page Generation

Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get...

CVE-2023-1716 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)

Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...

CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

A logic error when using mbstrpos to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload...

CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

A logic error when using mbstrpos to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload...

CVE-2023-43509: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading...

Trane HVAC Systems Controls Improper Neutralization of Input During Web Page Generation (CVE-2021-42534)

The affected product's web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2023-41681

A improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all...

CVE-2023-41836

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 through 3.0.7 allow...

CVE-2023-36637

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields...

CVE-2023-36637

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields...

CVE-2023-36637

Vulnerability summary: CVE-2023-36637 affects Fortinet FortiMail, specifically versions 7.2.0 through 7.2.2 and before 7.0.5. The issue is an improper neutralization of input during web page generation (CWE-79). An authenticated attacker can inject HTML tags into FortiMail’s calendar via input fi...

CVE-2023-36637

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields...

Cross site scripting

Improper Neutralization of Input During Web Page Generation ’Cross-site Scripting’ in RDT400 in SICK APU allows an unprivileged remote attacker to run arbitrary code in the clients browser via injecting code into the website...