Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 66
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 20125 Cwe 78120 Cwe 787105 Cwe 41699 Cwe 2296 Cwe 11990 Cwe 9484 Cwe 50270 Cwe 8954 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnerabilities tagged with this 3,514

ID Title
CVE-2016-5682 Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.
CVE-2016-4317 Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.
CVE-2016-4318 Cross-Site Scripting (XSS) in atlassian (CVE-2016-4318)
CVE-2016-5055 Cross-Site Scripting (XSS) in osram (CVE-2016-5055)
CVE-2016-5073 CloudView NMS before 2.10a has XSS via SNMP.
CVE-2016-5075 CloudView NMS before 2.10a has XSS via a TELNET login.
CVE-2016-5077 Netikus EventSentry before 3.2.1.44 has XSS via SNMP.
CVE-2016-5078 Paessler PRTG before 16.2.24.4045 has XSS via SNMP.
CVE-2015-2883 Cross-Site Scripting (XSS) in philips (CVE-2015-2883)
CVE-2015-6021 Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
CVE-2015-6027 Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.
CVE-2015-6035 Opsview before 2015-11-06 has XSS via SNMP.
CVE-2015-7275 Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
CVE-2017-7590 Cross-Site Scripting (XSS) in openidm-project (CVE-2017-7590)
CVE-2017-7591 Cross-Site Scripting (XSS) in openidm-project (CVE-2017-7591)
CVE-2017-7583 ILIAS before 5.2.3 has XSS via SVG documents.
CVE-2017-3848 Cross-Site Scripting (XSS) in cisco (CVE-2017-3848)
CVE-2017-3888 Cross-Site Scripting (XSS) in cisco (CVE-2017-3888)
CVE-2017-7579 inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
CVE-2015-4673 Cross-Site Scripting (XSS) in clip-bucket (CVE-2015-4673)
CVE-2016-1000307 Cross-Site Scripting (XSS) in clip-bucket (CVE-2016-1000307)
CVE-2016-3015 Cross-Site Scripting (XSS) in ibm (CVE-2016-3015)
CVE-2016-3031 Cross-Site Scripting (XSS) in ibm (CVE-2016-3031)
CVE-2017-6340 Cross-Site Scripting (XSS) in trendmicro (CVE-2017-6340)
CVE-2017-7400 Cross-Site Scripting (XSS) in openstack (CVE-2017-7400)
CVE-2016-8789 Cross-Site Scripting (XSS) in huawei (CVE-2016-8789)
CVE-2017-2475 Cross-Site Scripting (XSS) in apple (CVE-2017-2475)
CVE-2017-2445 Cross-Site Scripting (XSS) in apple (CVE-2017-2445)
CVE-2017-2393 Cross-Site Scripting (XSS) in apple (CVE-2017-2393)
CVE-2017-7388 Cross-Site Scripting (XSS) in wallaceit (CVE-2017-7388)

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →