Falhas do tipo CWE-79

28.384 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-2473MEDIUMWP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 1.4%CVE-2023-4136HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter EngineEPSS 1.4%CVE-2023-26843MEDIUMA stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the EPSS 1.4%CVE-2021-24807—Support Board < 3.3.5 - Agent+ Stored Cross-Site ScriptingEPSS 1.4%CVE-2022-0268MEDIUMCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 1.4%CVE-2022-0899—Header Footer Code Manager < 1.1.24 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2021-26947MEDIUMCross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbEPSS 1.4%CVE-2022-1910—Shortcodes and extra features for Phlox theme < 2.9.8 - Reflected Cross-Site-ScriptingEPSS 1.4%CVE-2024-47951LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settingsEPSS 1.4%CVE-2024-47950LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settingsEPSS 1.4%CVE-2018-1081—A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users cEPSS 1.4%CVE-2021-44178MEDIUMAdobe Experience Manager Reflected XSS in /bin/wcm/contentfinder/page/view.htmlEPSS 1.4%CVE-2024-47374HIGHWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.4%CVE-2022-26101—Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulneEPSS 1.4%CVE-2021-36027MEDIUMMagento Commerce Stored Cross-site Scripting VulnerabilityEPSS 1.4%CVE-2022-24399—The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file usingEPSS 1.4%CVE-2023-27335HIGHSofting edgeAggregator Client Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.4%CVE-2021-32702HIGHReflected XSS from the callback handler's error query parameterEPSS 1.4%CVE-2017-2683—A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-SitEPSS 1.4%CVE-2020-8189—A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invaEPSS 1.4%