Falhas do tipo CWE-80

630 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2020-11001MEDIUMPossible XSS attack in WagtailEPSS 1.3%CVE-2018-19952—If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP SystEPSS 1.3%CVE-2019-1010018—Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users bEPSS 1.3%CVE-2022-0989—NS WooCommerce Watermark <= 2.11.3 - Abuse of FunctionalityEPSS 1.2%CVE-2023-39216CRITICALImproper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privEPSS 1.2%CVE-2024-41810MEDIUMHTML injection in HTTP redirect bodyEPSS 1.2%CVE-2022-28703CRITICALA stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.EPSS 1.2%CVE-2019-13923—A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the afEPSS 1.1%CVE-2024-11954MEDIUMPimcore Search Document cross site scriptingEPSS 1.1%CVE-2022-24749MEDIUMBasic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusEPSS 1.1%CVE-2021-43862LOWSelf XSS on user inputEPSS 1.1%CVE-2021-29503HIGHImproper Neutralization of Script-Related HTML Tags in NotesEPSS 1.0%CVE-2020-2495—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%CVE-2020-2496—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%CVE-2020-27126MEDIUMCisco Webex Meetings API Cross-Site Scripting VulnerabilityEPSS 1.0%CVE-2022-36325MEDIUMAffected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remEPSS 1.0%CVE-2022-29252HIGHCross-site Scripting in XWiki Platform Wiki UI Main WikiEPSS 1.0%CVE-2022-29258HIGHCross-site Scripting in Filter Stream Converter Application in XWiki PlatformEPSS 1.0%CVE-2017-16043—Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will rEPSS 1.0%CVE-2020-2491—Cross-site Scripting Vulnerability in Photo StationEPSS 1.0%