Weaknesses of type CWE-79

30,669 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2018-0093—A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker EPSS 1.2%CVE-2017-12265—A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, reEPSS 1.2%CVE-2017-12272—A vulnerability in the web framework code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site sEPSS 1.2%CVE-2017-12296—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attacEPSS 1.2%CVE-2018-0206—A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeEPSS 1.2%CVE-2017-12304—A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remEPSS 1.2%CVE-2020-15179HIGHHTML Injection in ScratchSigEPSS 1.2%CVE-2018-0091—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.2%CVE-2018-0205—A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacEPSS 1.2%CVE-2017-12288—A vulnerability in the web-based management interface of Cisco Unified Contact Center Express could allow an unauthenticated, remote attackeEPSS 1.2%CVE-2020-7017—In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or crEPSS 1.2%CVE-2023-36459CRITICALMastodon vulnerable to Cross-site Scripting through oEmbed preview cardsEPSS 1.2%CVE-2020-14492MEDIUMOpenClinic GAEPSS 1.2%CVE-2021-36873MEDIUMWordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityEPSS 1.2%CVE-2022-35229LOWReflected XSS in discovery page of Zabbix FrontendEPSS 1.2%CVE-2023-0942MEDIUMJapanized For WooCommerce <= 2.5.4 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2021-0275HIGHJunos OS: J-Web: Cross-site scripting attack allows an attacker to gain control of another users session.EPSS 1.2%CVE-2023-50378MEDIUMApache Ambari: Various XSS problemsEPSS 1.2%CVE-2023-49145HIGHApache NiFi: Improper Neutralization of Input in Advanced User Interface for JoltEPSS 1.2%CVE-2019-1702MEDIUMCisco Enterprise Chat and Email Cross-Site Scripting VulnerabilitiesEPSS 1.2%