Falhas do tipo CWE-79

28.489 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-46278HIGHTeedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.EPSS 2.8%CVE-2021-26544—Apache Livy (Incubating) is vulnerable to cross site scriptingEPSS 2.8%CVE-2021-3672—A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to oEPSS 2.8%CVE-2023-23078MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in theEPSS 2.8%CVE-2023-23073MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.EPSS 2.8%CVE-2023-23077MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.EPSS 2.8%CVE-2020-9732CRITICALStored XSS in AEM Sites ComponentsEPSS 2.8%CVE-2022-0994—Hummingbird < 3.3.2 - Admin+ Stored Cross-Site ScriptingEPSS 2.8%CVE-2023-28347CRITICALAn issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that fEPSS 2.8%CVE-2021-24596—youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site ScriptingEPSS 2.8%CVE-2023-53931MEDIUMRevive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced SettingsEPSS 2.7%CVE-2023-1892HIGHCross-site Scripting (XSS) - Reflected in sidekiq/sidekiqEPSS 2.7%CVE-2021-22948—Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. UnEPSS 2.7%CVE-2020-25706MEDIUMA cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during teEPSS 2.7%CVE-2022-0653MEDIUMProfile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site ScriptingEPSS 2.7%CVE-2023-37269LOWWinter CMS vulnerable to stored XSS through privileged upload of SVG fileEPSS 2.7%CVE-2023-0902LOWSourceCodester Simple Food Ordering System process_order.php cross site scriptingEPSS 2.7%CVE-2023-26692MEDIUMZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Management System (ZBBS) 4.1EPSS 2.7%CVE-2022-42094MEDIUMBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.EPSS 2.7%CVE-2021-42551MEDIUMReflected XSS in NetBiblio WebOPAC search functionalityEPSS 2.7%