Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-25837HIGHBUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.EPSS 1.0%CVE-2022-44952MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/applicatioEPSS 1.0%CVE-2024-30047HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2024-30048HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2017-8440—Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtainEPSS 1.0%CVE-2017-8439—Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker toEPSS 1.0%CVE-2021-39355MEDIUMIndeed Job Importer <= 1.0.5 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2021-39356MEDIUMContent Staging <= 2.0.1 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-23598MEDIUMReflected XSS vulnerability when rendering error messages in laminas-formEPSS 1.0%CVE-2022-1504MEDIUMXSS in /demo/module/?module=HERE in microweber/microweberEPSS 1.0%CVE-2022-48426MEDIUMIn JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possibleEPSS 1.0%CVE-2023-4636MEDIUMWordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-31035CRITICALExternal URLs for Deployments can include javascript in argo-cdEPSS 1.0%CVE-2022-2685LOWSourceCodester Interview Management System addQuestion.php cross site scriptingEPSS 1.0%CVE-2024-51187MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2024-51190MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2021-33611MEDIUMReflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14EPSS 1.0%CVE-2024-51189MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2024-51188MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2020-2497—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%