Sign in Sign up
JA · EN · FR
SecPulse

Cross-Site Scripting

⚔️ Attack Types Related 27
slug: xss

Explanation

XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。 例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。 対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
📌 Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。

🔖 Related tags

Denial of Service85 SQL Injection23 Remote Code Execution19 Server-Side Request Forgery17 Path Traversal14 Privilege Escalation7 Authentication Bypass4 Insecure Deserialization4 Cross-Site Request Forgery1

🛡 Vulnerabilities tagged with this 3,313

ID Title
CVE-2017-3866 Cross-Site Scripting (XSS) in cisco (CVE-2017-3866)
CVE-2017-3868 Cross-Site Scripting (XSS) in cisco (CVE-2017-3868)
CVE-2017-3872 Cross-Site Scripting (XSS) in cisco (CVE-2017-3872)
CVE-2017-3874 Cross-Site Scripting (XSS) in cisco (CVE-2017-3874)
CVE-2014-8703 Cross-Site Scripting (XSS) in wondercms (CVE-2014-8703)
CVE-2014-8707 Cross-Site Scripting (XSS) in pluck-cms (CVE-2014-8707)
CVE-2015-3883 Cross-Site Scripting (XSS) in qdpm (CVE-2015-3883)
CVE-2017-6958 Cross-Site Scripting (XSS) in mantisbt (CVE-2017-6958)
CVE-2017-0107 Cross-Site Scripting (XSS) in microsoft (CVE-2017-0107)
CVE-2017-0110 Cross-Site Scripting (XSS) in microsoft (CVE-2017-0110)
CVE-2017-0055 Cross-Site Scripting (XSS) in microsoft (CVE-2017-0055)
CVE-2017-0017 Cross-Site Scripting (XSS) in microsoft (CVE-2017-0017)
CVE-2016-0770 Cross-Site Scripting (XSS) in wordpress (CVE-2016-0770)
CVE-2017-6061 Cross-Site Scripting (XSS) in sap (CVE-2017-6061)
CVE-2016-7103 Cross-Site Scripting (XSS) in jqueryui (CVE-2016-7103)
CVE-2017-6443 Cross-Site Scripting (XSS) in epson (CVE-2017-6443)
CVE-2017-5584 Cross-Site Scripting (XSS) in paloaltonetworks (CVE-2017-5584)
CVE-2017-5938 Cross-Site Scripting (XSS) in debian (CVE-2017-5938)
CVE-2016-8011 Cross-Site Scripting (XSS) in intel-security-mcafee (CVE-2016-8011)
CVE-2016-8019 Cross-Site Scripting (XSS) in mcafee (CVE-2016-8019)
CVE-2017-6877 Cross-Site Scripting (XSS) in lutim-project (CVE-2017-6877)
CVE-2014-3926 Cross-Site Scripting (XSS) in lg-project (CVE-2014-3926)
CVE-2017-5620 Cross-Site Scripting (XSS) in zammad (CVE-2017-5620)
CVE-2017-5621 Cross-Site Scripting (XSS) in zammad (CVE-2017-5621)
CVE-2017-6820 Cross-Site Scripting (XSS) in roundcube (CVE-2017-6820)
CVE-2017-6814 Cross-Site Scripting (XSS) in wordpress (CVE-2017-6814)
CVE-2017-6817 Cross-Site Scripting (XSS) in wordpress (CVE-2017-6817)
CVE-2017-6818 Cross-Site Scripting (XSS) in wordpress (CVE-2017-6818)
CVE-2017-6808 Cross-Site Scripting (XSS) in mangoswebv4-project (CVE-2017-6808)
CVE-2017-6809 Cross-Site Scripting (XSS) in mangoswebv4-project (CVE-2017-6809)

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →