CWE-692: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.
A kind of CWE-184 Incomplete List of Disallowed Inputs.
From the CWE List. © The MITRE Corporation.
Newest
- indico Indico: Cross-Site-Scripting in link fields 5.4 Medium
- thephpleague commonmark league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes 6.1 Medium
- hcl software aftermarket epc HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS... 4.3 Medium
- hcl software aftermarket epc HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web... 5.3 Medium
- dcooney ajax load more – infinite scroll, load more, & lazy load Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting 4.4 Medium
- cisco ios xe software A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote... 6.1 Medium
- the-scratch-channel the-scratch-channel.github.io The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability 1.3 Low
- cryptpad CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability 2.9 Low
- unopim UnoPim Stored XSS : Cookie hijacking through Create User function 6.5 Medium
- derbynet Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute... 4.6 Medium
- kitabisa teler-waf teler-waf contains detection rule bypass via entities payload 6.5 Medium