Falhas do tipo CWE-79

29.314 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-55878MEDIUMCross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLExEPSS 0.5%CVE-2022-45040MEDIUMA cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scEPSS 0.5%CVE-2024-33665MEDIUMangular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that thereEPSS 0.5%CVE-2024-0557LOWDedeBIZ Website Copyright Setting cross site scriptingEPSS 0.5%CVE-2022-2777MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.5%CVE-2024-37675MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%CVE-2021-39427MEDIUMCross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.pEPSS 0.5%CVE-2024-10887MEDIUMNiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-20265MEDIUMA vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to EPSS 0.5%CVE-2020-27478HIGHCross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf1EPSS 0.5%CVE-2024-53274LOWGHSL-2024-111: Reflected XSS in /home in habiticaEPSS 0.5%CVE-2023-51843HIGHreact-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set.EPSS 0.5%CVE-2023-43712MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-20800MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2023-46952MEDIUMCross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer headEPSS 0.5%CVE-2022-45613MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnEPSS 0.5%CVE-2024-48536HIGHIncorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a cEPSS 0.5%CVE-2024-2530LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php cross site scriptingEPSS 0.5%CVE-2024-53272MEDIUMGHSL-2024-109: Reflected XSS in /login in habiticaEPSS 0.5%CVE-2023-50376HIGHWordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)EPSS 0.5%