Falhas do tipo CWE-79

28.640 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2017-11481—Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtaiEPSS 0.8%CVE-2018-3820—Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacEPSS 0.8%CVE-2024-34831MEDIUMcross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter inEPSS 0.8%CVE-2023-49657CRITICALApache Superset: Stored XSS in Dashboard Title and Chart TitleEPSS 0.8%CVE-2016-6555HIGHOpenNMS Stored XSS via SNMP Trap AlertsEPSS 0.8%CVE-2023-39510MEDIUMStored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in CactiEPSS 0.8%CVE-2023-39512MEDIUMStored Cross-site Scripting on data_sources.php device name view in CactiEPSS 0.8%CVE-2016-6556HIGHOpenNMS Stored XSS via SNMP Agent DataEPSS 0.8%CVE-2022-30577HIGHTIBCO EBX Stored XSS vulnerabilityEPSS 0.8%CVE-2022-28216—SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unautEPSS 0.8%CVE-2020-4052MEDIUMStored XSS through template injection in Wiki.jsEPSS 0.8%CVE-2024-30264HIGHtypebot.io: `GHSL-2024-040`EPSS 0.8%CVE-2022-24397—SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflectEPSS 0.8%CVE-2022-20788MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-32782MEDIUMCross-Site Scripting in Nextcloud CirclesEPSS 0.8%CVE-2024-31065MEDIUMCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via tEPSS 0.8%CVE-2020-2005HIGHPAN-OS: GlobalProtect Clientless VPN session hijackingEPSS 0.8%CVE-2022-2140HIGHElcomplus SmartICS Cross-site ScriptingEPSS 0.8%CVE-2022-0753LOWCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 0.8%CVE-2021-32664HIGHReflected XSS in Combodo/iTopEPSS 0.8%