Falhas do tipo CWE-79

30.494 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-24383—WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 2.5%CVE-2023-52327MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52328MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52326MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2020-1055MEDIUMMicrosoft Active Directory Federation Services Cross-Site Scripting VulnerabilityEPSS 2.5%CVE-2023-2317HIGHTypora DOM-Based Cross-site Scripting leading to Remote Code ExecutionEPSS 2.4%CVE-2018-19787MEDIUMAn issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escEPSS 2.4%CVE-2021-34643MEDIUMSkaut bazar <= 1.3.2 Reflected Cross-Site ScriptingEPSS 2.4%CVE-2024-55890MEDIUMD-Tale allows Remote Code Execution through the Custom Filter InputEPSS 2.4%CVE-2022-0710MEDIUMHeader Footer Code Manager <= 1.1.16 Reflected XSSEPSS 2.4%CVE-2023-52330MEDIUMA cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installEPSS 2.4%CVE-2021-36738—XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portletEPSS 2.4%CVE-2021-36737—XSS in V3 Demo PortletEPSS 2.4%CVE-2021-36739MEDIUMXSS vulnerability in the MVCBean JSP portlet maven archetypeEPSS 2.4%CVE-2022-28221MEDIUMCleanTalk AntiSpam <= 5.173 Reflected XSSEPSS 2.4%CVE-2016-8613MEDIUMA flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitEPSS 2.4%CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2022-0928MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 2.4%CVE-2023-4382LOWtdevs Hyip Rio Profile Settings settings cross site scriptingEPSS 2.4%CVE-2023-6275LOWTOTVS Fluig Platform mobileredir openApp.jsp cross site scriptingEPSS 2.4%