80 matches found
Cross-site Scripting (XSS)
PrimeFaces is vulnerable to cross-site scripting XSS. The vulnerability exists due to the lack of validation for the parameter inputTextarea.getMaxlength on the server side, allowing an attacker to inject arbitrary Javascript into a victim's browser through the affected parameter...
HPE Intelligent Management Center (IMC) PrimeFaces Expression Language Injection Remote Code Execution Vulnerability
HPE Intelligent Management Center IMC is a comprehensive management platform built from the ground up to support the Failure, Configuration, Accounting, Performance and Security FCAPS model. A PrimeFaces expression language injection remote code execution vulnerability exists in HPE Intelligent...
(0Day) Hewlett Packard Enterprise Intelligent Management Center PrimeFaces Expression Language Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PrimeFaces endpoint. When parsing the...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of o.timeOnlyTitle, allowing XSS attacks...
Cross-Site Scripting (XSS)
PrimeFaces Extensions is vulnerable to cross-site scripting XSS. The vulnerability is possible because it fails to validate the input parameters in the triStateManyCheckbox function...
Primetek Primefaces Weak Encryption Remote Code Execution (CVE-2017-1000486)
Primefaces versions prior to 5.2.21, 5.3.8 or 6.0 are vulnerable to a padding oracle attack, due to the use of weak crypto and default encryption password...
Cross-site Scripting (XSS)
primefaces-extensions is vulnerable to cross-site scripting XSS attacks. The library does not escape the string input when setting the menuItem label, allowing a malicious user to inject and execute arbitrary Javascript...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the filename when a file is uploaded, allowing a malicious user to inject and execute arbitrary Javascript...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of msg in core.dialog.js...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of user sanitization of the value of summary in the fileUpload functionality...
Cross-Site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS. The attack is possible because the application does not perform enough sanitization on the following attributes: stateOneTitle, stateTwoTitle, stateThreeTitle in TriStateCheckboxRenderer.java...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the href value when rendered through printer.js, allowing XSS attacks to occur...
Cross-Site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS. The attack exists because it does not have adequate sanitization for the user input in PrimeFaces.escapeHTML function...
pro.primefaces.org XSS vulnerability
Open Bug Bounty ID: OBB-609289 Description| Value ---|--- Affected Website:| pro.primefaces.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Cross-site Scripting (XSS)
primefaces is vulnerable to multiple cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization for the values of the following views: tabView, carousel, dataGrid, dataList, pickList, commandButton...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of param values under non-AJAX implementations of AbstractMenu such as in BaseMenuRenderer...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the paramValue variable found in AjaxRequestBuilder, allowing malicious scripts to be executed when the values are displayed...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the item, and inputTextarea.getCounterTemplate attributes in the InputTextareaRenderer class...