Vulnerabilities > Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

DATE CVE VULNERABILITY TITLE RISK
2016-04-11 CVE-2016-2163 Cross-site Scripting vulnerability in Apache Openmeetings
Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating an event.
network
low complexity
apache CWE-79
6.1
2016-04-11 CVE-2016-0712 Cross-site Scripting vulnerability in Apache Jetspeed
Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.
network
low complexity
apache CWE-79
6.1
2016-04-11 CVE-2016-0711 Cross-site Scripting vulnerability in Apache Jetspeed
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource.
network
low complexity
apache CWE-79
6.1
2016-04-08 CVE-2016-2512 Cross-site Scripting vulnerability in Djangoproject Django
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
network
low complexity
djangoproject CWE-79
7.4
2016-04-08 CVE-2016-1375 Cross-site Scripting vulnerability in Cisco IP Interoperability and Collaboration System 4.10
Cross-site scripting (XSS) vulnerability in Cisco IP Interoperability and Collaboration System 4.10(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy12339.
network
low complexity
cisco CWE-79
6.1
2016-04-08 CVE-2016-1180 Cross-site Scripting vulnerability in Cyber-Will Social-Button Premium 1.0
Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
low complexity
cyber-will CWE-79
6.1
2016-04-08 CVE-2016-3978 Cross-site Scripting vulnerability in Fortinet Fortios
The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login."
network
low complexity
fortinet CWE-79
6.1
2016-04-07 CVE-2016-2789 Cross-site Scripting vulnerability in Citrix Xenmobile Server 10.0/10.1/10.3
Cross-site scripting (XSS) vulnerability in the Web User Interface in Citrix XenMobile Server 10.0, 10.1 before Rolling Patch 4, and 10.3 before Rolling Patch 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
low complexity
citrix CWE-79
6.1
2016-04-07 CVE-2016-2511 Cross-site Scripting vulnerability in multiple products
Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php.
network
low complexity
debian websvn CWE-79
6.1
2016-04-07 CVE-2016-3975 Cross-site Scripting vulnerability in SAP Netweaver Application Server Java
Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP Security Note 2238375.
network
low complexity
sap CWE-79
6.1