Falhas do tipo CWE-79

30.668 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-24807—Support Board < 3.3.5 - Agent+ Stored Cross-Site ScriptingEPSS 1.4%CVE-2022-0268MEDIUMCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 1.4%CVE-2022-2170—Microsoft Advertising Universal Event Tracking < 1.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 1.4%CVE-2016-10531—marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specificallEPSS 1.4%CVE-2018-1081—A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users cEPSS 1.4%CVE-2024-47951LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settingsEPSS 1.4%CVE-2022-48012MEDIUMOpencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settiEPSS 1.4%CVE-2024-47950LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settingsEPSS 1.4%CVE-2022-34870MEDIUMApache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web applicationEPSS 1.4%CVE-2018-3769—ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.EPSS 1.4%CVE-2022-26101—Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulneEPSS 1.4%CVE-2022-24399—The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file usingEPSS 1.4%CVE-2023-27335HIGHSofting edgeAggregator Client Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.4%CVE-2017-2683—A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-SitEPSS 1.4%CVE-2020-8189—A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invaEPSS 1.4%CVE-2021-26947MEDIUMCross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbEPSS 1.4%CVE-2022-28290—Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the userEPSS 1.4%CVE-2021-3994HIGHCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskEPSS 1.4%CVE-2021-32702HIGHReflected XSS from the callback handler's error query parameterEPSS 1.4%CVE-2021-28556MEDIUMMagento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript executionEPSS 1.4%