Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2020-2491—Cross-site Scripting Vulnerability in Photo StationEPSS 1.0%CVE-2020-2494—Cross-site Scripting Vulnerability in Music StationEPSS 1.0%CVE-2020-2497—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%CVE-2024-34070CRITICALFroxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromiseEPSS 1.0%CVE-2022-29252HIGHCross-site Scripting in XWiki Platform Wiki UI Main WikiEPSS 1.0%CVE-2022-29258HIGHCross-site Scripting in Filter Stream Converter Application in XWiki PlatformEPSS 1.0%CVE-2018-16555—A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All EPSS 0.9%CVE-2022-36325MEDIUMAffected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remEPSS 0.9%CVE-2021-1420MEDIUMCisco Webex Meetings HTML Injection VulnerabilityEPSS 0.9%CVE-2019-25028MEDIUMStored cross-site scripting in Grid component in Vaadin 7 and 8EPSS 0.9%CVE-2018-19954—The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could EPSS 0.9%CVE-2018-19956—The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could EPSS 0.9%CVE-2018-19955—The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could EPSS 0.9%CVE-2023-4663MEDIUMXSS in Saphira ConnectEPSS 0.9%CVE-2024-24574MEDIUMphpMyFAQ vulnerable to stored XSS on attachments filenameEPSS 0.9%CVE-2020-8966MEDIUMCross Site Scripting (XSS) flaws found in Tiki-Wiki CMS softwareEPSS 0.9%CVE-2019-25070LOWWolfCMS User Add cross site scriptingEPSS 0.8%CVE-2022-29168CRITICALCross Site Scripting in Wire MessagesEPSS 0.8%CVE-2017-20056LOWweblizar User Login Log Plugin Stored cross site scritingEPSS 0.8%CVE-2017-20055LOWBestWebSoft Contact Form Plugin Stored cross site scritingEPSS 0.8%