Falhas do tipo CWE-79

30.673 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2018-3755—XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element uEPSS 0.9%CVE-2018-0367—A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attackerEPSS 0.9%CVE-2018-15634HIGHCross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows reEPSS 0.9%CVE-2019-3873MEDIUMIt was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XMEPSS 0.9%CVE-2019-1719MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2023-3086CRITICALCross-site Scripting (XSS) - Stored in nilsteampassnet/teampassEPSS 0.9%CVE-2021-39336MEDIUMJob Manager <= 0.7.25 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-39335MEDIUMWpGenius Job Listing <= 1.0.2 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-39337MEDIUMjob-portal <= 0.0.1 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-39334MEDIUMJob Board Vanila Plugin <= 1.0 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-25041—Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2024-21620HIGHJunos OS: SRX Series and EX Series: J-Web doesn't sufficiently sanitize input to prevent XSSEPSS 0.9%CVE-2022-2218CRITICALCross-site Scripting (XSS) - Stored in ionicabizau/parse-urlEPSS 0.9%CVE-2022-1269—Fast Flow < 1.2.12 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-1005—WP Statistics < 13.2.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-21146MEDIUMICSA-22-062-01 IPCOMM ipDIOEPSS 0.9%CVE-2022-30596—A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent EPSS 0.9%CVE-2024-54037HIGHAdobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2021-4139MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.9%CVE-2020-35037—Events Manager < 5.9.8 - Cross-Site Scripting (XSS)EPSS 0.9%