Fallos del tipo CWE-94

4891 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2021-26731CRITICALspx_restservice modifyUserb_func Command Injection and Multiple Stack-Based Buffer OverflowsEPSS 2.7%CVE-2024-42845HIGHAn eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to exEPSS 2.7%CVE-2019-10182HIGHIt was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could tEPSS 2.7%CVE-2019-15599—A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the EPSS 2.7%CVE-2026-69251CRITICALFlowise RCE via TypeORM DataSourceEPSS 2.7%CVE-2019-15597—A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.EPSS 2.7%CVE-2019-15598—A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the cEPSS 2.7%CVE-2021-26727CRITICALspx_restservice SubNet_handler_func Multiple Command Injections and Stack-Based Buffer OverflowsEPSS 2.7%CVE-2021-26729CRITICALspx_restservice Login_handler_func Command Injection and Multiple Stack-Based Buffer OverflowsEPSS 2.7%CVE-2021-26728CRITICALspx_restservice KillDupUsr_func Command Injection and Stack-Based Buffer OverflowEPSS 2.7%CVE-2020-21016CRITICALD-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.EPSS 2.7%CVE-2023-29492CRITICALNovi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This doeEPSS 2.7%KEVCVE-2020-11079HIGHcommand injection fix in node-dns-syncEPSS 2.7%CVE-2022-25894CRITICALAll versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jeEPSS 2.7%CVE-2022-23631CRITICALPrototype Pollution leading to Remote Code Execution in superjsonEPSS 2.7%CVE-2021-40485HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 2.7%CVE-2017-16151—Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects alEPSS 2.7%CVE-2018-19002—LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, wEPSS 2.7%CVE-2026-24516HIGHA command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner component (internal/troubEPSS 2.7%CVE-2011-10011CRITICALWeBid 1.0.2 converter.php Remote PHP Code InjectionEPSS 2.6%