Sign in Sign up
JA · EN · FR
SecPulse

Cross-Site Scripting

⚔️ Attack Types Related 27
slug: xss

Explanation

XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。 例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。 対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
📌 Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。

🔖 Related tags

Denial of Service85 SQL Injection23 Remote Code Execution19 Server-Side Request Forgery17 Path Traversal14 Privilege Escalation7 Authentication Bypass4 Insecure Deserialization4 Cross-Site Request Forgery1

🛡 Vulnerabilities tagged with this 3,314

ID Title
CVE-2017-9451 Cross-Site Scripting (XSS) in flatcore (CVE-2017-9451)
CVE-2017-9452 Cross-Site Scripting (XSS) in piwigo (CVE-2017-9452)
CVE-2017-9448 Cross-Site Scripting (XSS) in bigtreecms (CVE-2017-9448)
CVE-2017-9332 Cross-Site Scripting (XSS) in pivotx (CVE-2017-9332)
CVE-2017-9420 Cross-Site Scripting (XSS) in wordpress (CVE-2017-9420)
CVE-2017-9441 Cross-Site Scripting (XSS) in bigtreecms (CVE-2017-9441)
CVE-2017-8439 Cross-Site Scripting (XSS) in elastic (CVE-2017-8439)
CVE-2017-8440 Cross-Site Scripting (XSS) in elastic (CVE-2017-8440)
CVE-2017-8838 Cross-Site Scripting (XSS) in peplink (CVE-2017-8838)
CVE-2017-8839 Cross-Site Scripting (XSS) in peplink (CVE-2017-8839)
CVE-2012-6705 Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field.
CVE-2017-9361 WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.
CVE-2017-9366 Cross-Site Scripting (XSS) in epesi (CVE-2017-9366)
CVE-2017-7384 Cross-Site Scripting (XSS) in flipbuilder (CVE-2017-7384)
CVE-2017-3127 Cross-Site Scripting (XSS) in fortinet (CVE-2017-3127)
CVE-2017-9331 Cross-Site Scripting (XSS) in epesi (CVE-2017-9331)
CVE-2017-9336 The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.
CVE-2017-9337 Cross-Site Scripting (XSS) in wordpress (CVE-2017-9337)
CVE-2017-9305 Cross-Site Scripting (XSS) in tiki (CVE-2017-9305)
CVE-2017-9306 Cross-Site Scripting (XSS) in syspass (CVE-2017-9306)
CVE-2017-2307 Cross-Site Scripting (XSS) in juniper (CVE-2017-2307)
CVE-2017-9299 Cross-Site Scripting (XSS) in otrs (CVE-2017-9299)
CVE-2017-9298 Cross-Site Scripting (XSS) in hitachi (CVE-2017-9298)
CVE-2017-9289 Cross-Site Scripting (XSS) in note-project (CVE-2017-9289)
CVE-2017-9292 Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782.
CVE-2017-9288 Cross-Site Scripting (XSS) in wordpress (CVE-2017-9288)
CVE-2017-9249 Cross-Site Scripting (XSS) in allen-disk-project (CVE-2017-9249)
CVE-2017-9251 Cross-Site Scripting (XSS) in finecms-project (CVE-2017-9251)
CVE-2017-9252 Cross-Site Scripting (XSS) in finecms-project (CVE-2017-9252)
CVE-2017-9243 Cross-Site Scripting (XSS) in aries-networks (CVE-2017-9243)

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →