Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-29206CRITICALorg.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX pluginsEPSS 0.9%CVE-2022-1250—LifterLMS PayPal < 1.4.0 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-36108MEDIUMCross-Site Scripting in typo3/cms-coreEPSS 0.9%CVE-2023-28120MEDIUMThere is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.EPSS 0.9%CVE-2018-10934MEDIUMA cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles tEPSS 0.9%CVE-2020-25163HIGHOSIsoft PI Vision Cross-site ScriptingEPSS 0.9%CVE-2026-55034HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2026-96230HIGHASP.NET Core Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-55021HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2021-39338MEDIUMMyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-22571—An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all EPSS 0.9%CVE-2022-2932CRITICALCross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kitEPSS 0.9%CVE-2022-3072HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%CVE-2019-10177MEDIUMA stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user inEPSS 0.9%CVE-2022-40956MEDIUMWhen injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. EPSS 0.9%CVE-2013-4170—In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, theEPSS 0.9%CVE-2021-24808—BP Better Messages < 1.9.9.41 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2020-8294—A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet ExplorerEPSS 0.9%CVE-2021-21365MEDIUMCross-Site Scripting in Content RenderingEPSS 0.9%CVE-2022-39331MEDIUMCross-site Scripting (XSS) in Nexcloud Desktop ClientEPSS 0.9%