Falhas do tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-45037MEDIUMA cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts orEPSS 1.1%CVE-2022-45038MEDIUMA cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts EPSS 1.1%CVE-2021-39199CRITICALCross site scripting via unsafe defaults in remark-htmlEPSS 1.1%CVE-2021-35240MEDIUMStored XSS via Help Server settingsEPSS 1.1%CVE-2018-14664MEDIUMA flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code inEPSS 1.1%CVE-2024-23349MEDIUMApache Answer: XSS vulnerability when submitting summaryEPSS 1.1%CVE-2021-43761HIGHAdobe Experience Manager Stored XSS on Edit Tag page via Localization inputEPSS 1.1%CVE-2024-28715HIGHCross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functioEPSS 1.1%CVE-2023-28350MEDIUMAn issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered EPSS 1.1%CVE-2022-1820MEDIUMKeep Backup Daily <= 2.0.2 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2022-1822MEDIUMZephyr Project Manager <= 3.2.40 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2023-36007HIGHMicrosoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityEPSS 1.1%CVE-2019-1856MEDIUMCisco Prime Collaboration Assurance Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2024-31835MEDIUMCross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload EPSS 1.1%CVE-2024-21908MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.1%CVE-2020-3121MEDIUMCisco Small Business Smart and Managed Switches Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2022-28820MEDIUMAdobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code ExecutionEPSS 1.1%CVE-2008-3397MEDIUMCross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script orEPSS 1.1%CVE-2024-34342HIGHreact-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFEPSS 1.1%CVE-2020-8347MEDIUMA reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 tEPSS 1.1%