CWE-81: Improper Neutralization of Script in an Error Message Web Page
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- docker engine, moby, mobyproject moby\/v2 +2 more Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap 6.1 Medium
- bosch rexroth ag ctrlx os - solutions A vulnerability in the error notification messages of the web application of ctrlX OS allows a... 6.3 Medium
- opentext™ service manager vulnerability has been discovered in OpenText™ Service Manager. 2.1 Low
- openrefine OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project 5.9 Medium
- cvat computer vision annotation tool, cvat-ai cvat +1 more Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints 6.3 Medium
- journyx, journyx (jtime) +1 more Journyx Reflected Cross Site Scripting 6.1 Medium
- keycloak, redhat openshift container platform, openshift container platform for ibm linuxone +2 more +4 more Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC 10.0 Critical
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +3 more +5 more Keycloak: reflected xss attack 8.1 High
- flow flow-server, vaadin flow, vaadin +2 more Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 6.1 Medium
-
com.vaadin:vaadin-bomMaven Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 6.1 Medium