CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page
The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- plex media server Plex Media Server URL injection 6.9 Medium
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +1 more +3 more Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction 6.3 Medium
- lissy93 dashy Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 5.9 Medium
- jupyterlab JupyterLab before 4.5.9 Stored XSS via Extension Manager 5.1 Medium
- orval Orval has a code injection via unsanitized x-enum-descriptions uing JS comments 9.3 Critical
- mcpjam inspector MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server 8.6 High
- ibm engineering lifecycle optimization, engineering lifecycle optimization - publishing +1 more IBM Engineering Lifecycle Optimization - Publishing cross-site scripting 6.1 Medium
- enalean tuleap Tuleap allows XSS via the content of RSS feeds in the RSS widgets 4.8 Medium
- No product listed An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive... 5.5 Medium
- No product listed An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user... 5.5 Medium
- No product listed An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user... 5.5 Medium
- No product listed An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows... 5.5 Medium
- No product listed An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0... 5.5 Medium
- No product listed An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows... 5.5 Medium
- No product listed An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access... 5.5 Medium
- No product listed An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows... 5.5 Medium
- hcl software bigfix patch management download plug-ins HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme 2.5 Low
- collabora online JavaScript Injection via url encoded values in links in Collabora Office Android 6.3 Medium
- palantir apollo autopilot, com.palantir.apollo:autopilot +1 more Stored XSS via javascript URI in Apollo Change Requests comment 4.1 Medium
- backstage, linuxfoundation backstage catalog-model, backstage core-components +1 more +3 more Backstage has XSS Vulnerability in Software Catalog 6.8 Medium
- siemens desigo pxm30-1, desigo pxm30.e, desigo pxm40-1 +17 more +19 more A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo... 8.3 High
- openvpn access server OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script... 6.1 Medium
- elastic app search Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be… 6.1 Medium