Sign in Sign up
JA · EN · FR
SecPulse

Cross-Site Scripting

⚔️ Attack Types Related 27
slug: xss

Explanation

XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。 例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。 対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
📌 Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。

🔖 Related tags

Denial of Service85 SQL Injection23 Remote Code Execution19 Server-Side Request Forgery17 Path Traversal14 Privilege Escalation7 Authentication Bypass4 Insecure Deserialization4 Cross-Site Request Forgery1

🛡 Vulnerabilities tagged with this 3,314

ID Title
CVE-2017-12971 Cross-Site Scripting (XSS) in apache2triad (CVE-2017-12971)
CVE-2017-12844 Cross-Site Scripting (XSS) in icewarp (CVE-2017-12844)
CVE-2017-13138 Cross-Site Scripting (XSS) in wordpress (CVE-2017-13138)
CVE-2014-6189 Cross-Site Scripting (XSS) in ibm (CVE-2014-6189)
CVE-2017-7421 Cross-Site Scripting (XSS) in microfocus (CVE-2017-7421)
CVE-2017-7422 Cross-Site Scripting (XSS) in microfocus (CVE-2017-7422)
CVE-2017-12978 Cross-Site Scripting (XSS) in cacti (CVE-2017-12978)
CVE-2017-12979 Cross-Site Scripting (XSS) in dokuwiki (CVE-2017-12979)
CVE-2017-12980 Cross-Site Scripting (XSS) in dokuwiki (CVE-2017-12980)
CVE-2017-12984 Cross-Site Scripting (XSS) in phpmywind (CVE-2017-12984)
CVE-2017-12882 Cross-Site Scripting (XSS) in spring-batch-admin-project (CVE-2017-12882)
CVE-2017-12948 Cross-Site Scripting (XSS) in wordpress (CVE-2017-12948)
CVE-2015-5057 Cross-Site Scripting (XSS) in wordpress (CVE-2015-5057)
CVE-2017-12591 Cross-Site Scripting (XSS) in asus (CVE-2017-12591)
CVE-2017-12680 Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.
CVE-2017-9767 Cross-Site Scripting (XSS) in quali (CVE-2017-9767)
CVE-2017-9816 Cross-Site Scripting (XSS) in paessler (CVE-2017-9816)
CVE-2017-1338 Cross-Site Scripting (XSS) in ibm (CVE-2017-1338)
CVE-2017-12927 Cross-Site Scripting (XSS) in cacti (CVE-2017-12927)
CVE-2017-12907 Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.
CVE-2017-6776 Cross-Site Scripting (XSS) in cisco (CVE-2017-6776)
CVE-2017-6788 Cross-Site Scripting (XSS) in cisco (CVE-2017-6788)
CVE-2016-6021 Cross-Site Scripting (XSS) in ibm (CVE-2016-6021)
CVE-2017-9655 Cross-Site Scripting (XSS) in osisoft (CVE-2017-9655)
CVE-2017-9802 Cross-Site Scripting (XSS) in apache (CVE-2017-9802)
CVE-2015-3615 Cross-Site Scripting (XSS) in privilege-escalation (CVE-2015-3615)
CVE-2017-9556 Cross-Site Scripting (XSS) in synology (CVE-2017-9556)
CVE-2017-12798 Cross-Site Scripting (XSS) in nexusphp-project (CVE-2017-12798)
CVE-2016-6812 Cross-Site Scripting (XSS) in apache (CVE-2016-6812)
CVE-2017-1168 Cross-Site Scripting (XSS) in ibm (CVE-2017-1168)

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →