Falhas do tipo CWE-79

28.612 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-1559—Clipr <= 1.2.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.0%CVE-2020-2494—Cross-site Scripting Vulnerability in Music StationEPSS 1.0%CVE-2020-2491—Cross-site Scripting Vulnerability in Photo StationEPSS 1.0%CVE-2024-30047HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2022-4865HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 1.0%CVE-2022-4866CRITICALCross-site Scripting (XSS) - Stored in usememos/memosEPSS 1.0%CVE-2023-25837HIGHBUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.EPSS 1.0%CVE-2024-30048HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2017-8440—Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtainEPSS 1.0%CVE-2017-8439—Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker toEPSS 1.0%CVE-2021-39356MEDIUMContent Staging <= 2.0.1 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-1504MEDIUMXSS in /demo/module/?module=HERE in microweber/microweberEPSS 1.0%CVE-2021-39355MEDIUMIndeed Job Importer <= 1.0.5 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-23598MEDIUMReflected XSS vulnerability when rendering error messages in laminas-formEPSS 1.0%CVE-2024-11325MEDIUMAWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-4636MEDIUMWordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 1.0%CVE-2021-33611MEDIUMReflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14EPSS 1.0%CVE-2015-20105—ClickBank Affiliate Ads <= 1.20 - CSRF to Stored Cross-Site ScriptingEPSS 1.0%CVE-2023-5538HIGHMpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2019-10178MEDIUMIt was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored CroEPSS 1.0%