apache__myfaces_CVE-2011-4367_2-0-11

Apache's implementation of the JavaServer Faces JSF and Jakarta Faces specification Branches main Jakarta Faces 5.0 implementation 4.1.x Jakarta Faces 4.1 implementation 4.0.x Jakarta Faces 4.0 implementation Based on the refactored 2.3-next codebase 2.3-next Almost JavaServer Faces 2.3...

CVE-2026-68536

A flaw was found in Apache MyFaces Core. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF, which can trick the server into making requests to arbitrary domains, potentially accessing internal resources. Additionally, Local File Inclusion LFI is possible,...

CVE-2026-76646 Apache MyFaces: Denial of Service via Unbounded Request Parsing

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

CVE-2026-76646 Apache MyFaces: Denial of Service via Unbounded Request Parsing

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

CVE-2026-76646

The Apache MyFaces framework is vulnerable to a Denial of Service (DoS) condition due to unbounded request parsing . A remote attacker can trigger excessive resource consumption by providing specially crafted request parameters. To remediate this issue, users are recommended to upgrade to version...

CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...

CVE-2026-68536

A flaw in Apache MyFaces Core allows a remote attacker to perform Server-Side Request Forgery (SSRF) , which can trick the server into making requests to arbitrary domains to access internal resources. Additionally, the vulnerability allows for Local File Inclusion (LFI) , enabling attackers to i...

CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...

EUVD-2021-1329

Malware in sbrugna...

EUVD-2022-5742

Malicious code in bioql PyPI...

EUVD-2022-4414

Malicious code in bioql PyPI...

EUVD-2022-3270

Malicious code in bioql PyPI...

EUVD-2022-2370

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2010-2057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message...

Security Bulletin: A vulnerability in WebSphere Application Server Liberty affects IBM CICS TX on Cloud

Summary IBM CICS TX on Cloud has addressed the following vulnerability reported by WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By...

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring installed WebSphere Application Server

Summary The following security issues have been identified in the WebSphere Application Server included as part of IBM Tivoli Monitoring ITM portal server. Vulnerability Details CVEID:CVE-2021-20454 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML Extern...

Security Bulletin: Vulnerability in Apache MyFaces affects Liberty for Java for IBM Cloud (CVE-2021-26296)

Summary There is a vulnerability in the Apache MyFaces library used by WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an...

Apache MyFaces Cross-site Scripting vulnerability

Apache MyFaces 1.1.7 and 1.2.8 All previous versions are likely vulnerable, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting XSS attacks or execute arbitrary...

GHSA-4FV4-CQ5V-X45M Improper Authentication in Apache MyFaces

shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code MAC, which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracl...

Improper Authentication in Apache MyFaces

shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code MAC, which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracl...