Weaknesses of type CWE-79

30,666 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-29927MEDIUMIn JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possibleEPSS 1.6%CVE-2019-0047HIGHJunos OS: Persistent XSS vulnerability in J-WebEPSS 1.6%CVE-2020-1760MEDIUMA flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potenEPSS 1.6%CVE-2020-1673HIGHJunos OS: Reflected Cross-site Scripting vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 1.6%CVE-2023-41176MEDIUMReflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticEPSS 1.6%CVE-2023-41178MEDIUMReflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticEPSS 1.6%CVE-2020-0694MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2020-0795MEDIUMThis vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.EPSS 1.5%CVE-2020-11082MEDIUMCross-Site Scripting in KaminariEPSS 1.5%CVE-2021-24522—ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widgetEPSS 1.5%CVE-2023-48082CRITICALNagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generatEPSS 1.5%CVE-2023-27905CRITICALJenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resultinEPSS 1.5%CVE-2021-32641HIGHReflected XSS when using flashMessagesEPSS 1.5%CVE-2022-1173HIGHstored xss in getgrav/gravEPSS 1.5%CVE-2011-3344MEDIUMSpacewalk: spacewalk: cross-site scripting via uri in lookup login/password formEPSS 1.5%CVE-2023-0676LOWCross-site Scripting (XSS) - Reflected in phpipam/phpipamEPSS 1.5%CVE-2021-24834—YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options ModuleEPSS 1.5%CVE-2018-7512—A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1EPSS 1.5%CVE-2020-1298MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.5%CVE-2020-11025MEDIUMAuthenticated cross-site scripting (XSS) in WordPress CustomizerEPSS 1.5%