Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-7027HIGHPOST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via deviceEPSS 0.9%CVE-2020-8294—A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet ExplorerEPSS 0.9%CVE-2016-10366—Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.EPSS 0.9%CVE-2022-40004CRITICALCross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit LoEPSS 0.9%CVE-2021-38341MEDIUMWooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38327MEDIUMYouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34644MEDIUMMultiplayer Games <= 3.7 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2019-10179MEDIUMA vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize reEPSS 0.9%CVE-2021-43861HIGHIncorrect sanitisation function leads to `XSS`EPSS 0.9%CVE-2023-36410HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.9%CVE-2021-38316MEDIUMWP Academic People List <= 0.4.1 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38355MEDIUMBug Library <= 2.0.3 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38330MEDIUMYet Another bol.com Plugin <= 1.4 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38315MEDIUMSP Project & Document Manager <= 4.25 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2023-36031HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.9%CVE-2021-38323MEDIUMRentPress <= 6.6.4 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34642MEDIUMSmart Email Alerts <= 1.0.10 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34635MEDIUMPoll Maker <= 3.2.8 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34664MEDIUMMoova for WooCommerce <= 3.5 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38333MEDIUMWP Scrippets <= 1.5.1 Reflected Cross-Site ScriptingEPSS 0.9%