Book møte

Sårbarheter

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Svakhetstype fra CWE-katalogen

Hva svakheten betyr

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Definisjonen gjengis slik MITRE har publisert den, på engelsk.

18 104 sårbarheter i tjenesten peker på denne svakheten

  1. CVE-2022-42948 Utnyttes aktivt Kritisk 9.8

    Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

    Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

  2. CVE-2019-3929 Utnyttes aktivt Kritisk 9.8

    Crestron Multiple Products Command Injection Vulnerability

    The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 fir…

  3. CVE-2024-42009 Utnyttes aktivt Kritisk 9.3

    RoundCube Webmail Cross-Site Scripting Vulnerability

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desani…

  4. CVE-2023-34192 Utnyttes aktivt Kritisk 9.0

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

  5. CVE-2019-18426 Utnyttes aktivt Høy 8.2

    WhatsApp Cross-Site Scripting Vulnerability

    A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulner…

  6. CVE-2024-43573 Utnyttes aktivt Høy 8.1

    Microsoft Windows MSHTML Platform Spoofing Vulnerability

    Windows MSHTML Platform Spoofing Vulnerability

  7. CVE-2024-44309 Utnyttes aktivt Middels 6.3

    Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

    A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionO…

  8. CVE-2026-42897 Utnyttes aktivt Middels 6.1

    Microsoft Exchange Server Cross-Site Scripting Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  9. CVE-2025-66376 Utnyttes aktivt Middels 6.1

    Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

  10. CVE-2025-68461 Utnyttes aktivt Middels 6.1

    RoundCube Webmail Cross-site Scripting Vulnerability

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

  11. CVE-2025-48700 Utnyttes aktivt Middels 6.1

    Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaS…

  12. CVE-2024-11182 Utnyttes aktivt Middels 6.1

    MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

    An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbit…

  13. CVE-2024-27443 Utnyttes aktivt Middels 6.1

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, becau…

  14. CVE-2024-37383 Utnyttes aktivt Middels 6.1

    RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

  15. CVE-2023-43770 Utnyttes aktivt Middels 6.1

    Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

  16. CVE-2023-37580 Utnyttes aktivt Middels 6.1

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

  17. CVE-2022-39197 Utnyttes aktivt Middels 6.1

    Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerabi…

  18. CVE-2022-27926 Utnyttes aktivt Middels 6.1

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web scrip…

  19. CVE-2022-24682 Utnyttes aktivt Middels 6.1

    Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

    An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML…

  20. CVE-2021-1879 Utnyttes aktivt Middels 6.1

    Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability

    This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lea…

  21. CVE-2020-35730 Utnyttes aktivt Middels 6.1

    Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference el…

  22. CVE-2018-19953 Utnyttes aktivt Middels 6.1

    QNAP NAS File Station Cross-Site Scripting Vulnerability

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20…

  23. CVE-2020-3580 Utnyttes aktivt Middels 6.1

    Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability

    Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote att…

  24. CVE-2020-13965 Utnyttes aktivt Middels 6.1

    Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

  25. CVE-2020-11023 Utnyttes aktivt Middels 6.1

    JQuery Cross-Site Scripting (XSS) Vulnerability

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation m…