This article provides a list of tags to avoid using to prevent
cross-site scripting (XSS) vulnerabilities with MSME.
When configuring options such as notifications or policy names in MSME, do not use tags that contain the following strings. These tags can cause XSS vulnerabilities.
Tags you must avoid using:
- INPUT
- iframe
- XSS
- FRAME
- BASE
- OBJECT
- EMBED
- BGSOUND
- SCRIPT
