Falhas do tipo CWE-79

28.384 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2020-0693MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2023-1496MEDIUMCross-site Scripting (XSS) - Reflected in imgproxy/imgproxyEPSS 1.6%CVE-2019-0963MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2024-35266HIGHAzure DevOps Server Spoofing VulnerabilityEPSS 1.6%CVE-2021-24657—Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.6%CVE-2024-35267HIGHAzure DevOps Server Spoofing VulnerabilityEPSS 1.6%CVE-2018-8650MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2021-41165HIGHHTML comments vulnerability allowing to execute JavaScript codeEPSS 1.6%CVE-2022-0148—All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.6%CVE-2024-32077MEDIUMApache Airflow: XSS vulnerability in Task Instance Log/Log DetailsEPSS 1.6%CVE-2019-0831MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2019-1134MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2019-0830MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2020-12021—In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attEPSS 1.6%CVE-2020-26298MEDIUMInjection in RedcarpetEPSS 1.6%CVE-2021-21422HIGHXSS Vulnerability in mongo-expressEPSS 1.6%CVE-2021-24910—Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site ScriptingEPSS 1.6%CVE-2020-1454MEDIUMThis vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.EPSS 1.6%CVE-2023-22462MEDIUMStored XSS in Grafana Text pluginEPSS 1.6%CVE-2019-15587—In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.EPSS 1.6%