Falhas do tipo CWE-79

28.778 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-35131MEDIUMMoodle: xss risk on groups pageEPSS 0.7%CVE-2023-43343MEDIUMCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scrEPSS 0.7%CVE-2024-24506MEDIUMCross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrEPSS 0.7%CVE-2022-35721MEDIUMIBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaSEPSS 0.7%CVE-2019-10146MEDIUMA Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service EPSS 0.7%CVE-2022-2374—Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2020-13672—Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circuEPSS 0.7%CVE-2022-1997HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.7%CVE-2024-34120MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2022-1590LOWBludit New Content Module new-content cross site scriptingEPSS 0.7%CVE-2024-36142MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-26121MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2021-24616—AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24598—Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-26117MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.7%CVE-2024-26085MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-10234MEDIUMWildfly: wildfly vulnerable to cross-site scripting (xss)EPSS 0.7%CVE-2021-24658—Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2024-26123MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2021-24574—Simple Banner < 2.10.4 - Authenticated Stored XSSEPSS 0.7%