Falhas do tipo CWE-79

30.670 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-36007HIGHMicrosoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityEPSS 1.1%CVE-2022-41224MEDIUMJenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the JenkinsEPSS 1.1%CVE-2023-28350MEDIUMAn issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered EPSS 1.1%CVE-2022-22115CRITICALTeedy - Stored Cross-Site Scripting (XSS) in Tag NameEPSS 1.1%CVE-2019-1856MEDIUMCisco Prime Collaboration Assurance Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12695MEDIUMCisco Adaptive Security Appliance and Firepower Threat Defense Software WebVPN Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2024-21908MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.1%CVE-2020-3121MEDIUMCisco Small Business Smart and Managed Switches Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2024-31835MEDIUMCross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload EPSS 1.1%CVE-2024-33905MEDIUMIn Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.EPSS 1.1%CVE-2022-28820MEDIUMAdobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code ExecutionEPSS 1.1%CVE-2008-3397MEDIUMCross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script orEPSS 1.1%CVE-2026-111233LOWNetgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.phpEPSS 1.1%CVE-2024-34342HIGHreact-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFEPSS 1.1%CVE-2020-8347MEDIUMA reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 tEPSS 1.1%CVE-2023-5863HIGHCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 1.1%CVE-2017-7422—Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise SeEPSS 1.1%CVE-2017-15888—Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticatEPSS 1.1%CVE-2024-22397HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticaEPSS 1.1%CVE-2018-3726—crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.EPSS 1.1%