be.atbash.ee.jsf.valerie:valerie-primefaces (>=0.9.0, <=0.9.0.3), be.atbash.ee.security:totp-web (>=0.5, <=0.6) +64 more potentially affected by CVE-2017-1000486 via org.primefaces:primefaces (>=5.0, <=5.3)

org.primefaces:primefaces MAVEN version =5.0, =0.9.0, =0.5, =1.0.0, =1.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =3.2.1036, =1.3.0, =1.4.2 and more Source cves: CVE-2017-1000486 Source advisory: OSV:GHSA-J239-4GQG-5J54...

Inadequate Encryption Strength

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution...

ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6), ch.sbb.releasetrain:webui (>=0.0.25, <=0.9.6) +58 more potentially affected by CVE-2020-10544 via org.primefaces:primefaces (6.0)

org.primefaces:primefaces MAVEN version 6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.primefaces:primefaces and may be impacted: - ch.sbb.releasetrain:jsfbootadapter =0.0.25, =0.0.25, =3.0.0.release, =1.0.0, =3.3.7, =1.0.0-rc1, =1.6.1, =1.7.0...

be.atbash.ee.security.octopus.opinionated:jsf (0.6), br.com.jarch:jarch-annotation (>=19.8.0, <=20.2.0) +35 more potentially affected by CVE-2020-10544 via org.primefaces:primefaces (7.0)

org.primefaces:primefaces MAVEN version 7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.primefaces:primefaces and may be impacted: - be.atbash.ee.security.octopus.opinionated:jsf 0.6 - br.com.jarch:jarch-annotation =19.8.0, =19.8.0, =19.8.0,...

br.net.woodstock.rockframework:rockframework-web (3.0.1), com.enioka.jqm:jqm-jsfsample (>=1.2.1, <=1.4.2) +42 more potentially affected by CVE-2020-10544 via org.primefaces:primefaces (4.0)

org.primefaces:primefaces MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.primefaces:primefaces and may be impacted: - br.net.woodstock.rockframework:rockframework-web 3.0.1 - com.enioka.jqm:jqm-jsfsample =1.2.1, =1.0.0.final, =1....

be.atbash.ee.jsf.valerie:valerie-primefaces (>=0.9.0, <=0.9.0.3), com.a9ski.jsf:simple-jsf-exporter-primefaces-excel (>=1.0.0, <=1.0.3) +18 more potentially affected by CVE-2020-10544 via org.primefaces:primefaces (5.1)

org.primefaces:primefaces MAVEN version 5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.primefaces:primefaces and may be impacted: - be.atbash.ee.jsf.valerie:valerie-primefaces =0.9.0, =1.0.0, =1.0.0, =0.1, =4.1.0, =4.1.0, =4.4.0, =4.1.0, =0.16...

be.atbash.ee.security:totp-web (>=0.5, <=0.6), com.exactpro.sf:sailfish-frontend (>=3.2.1036, <=3.2.1881) +10 more potentially affected by CVE-2020-10544 via org.primefaces:primefaces (5.0)

org.primefaces:primefaces MAVEN version 5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.primefaces:primefaces and may be impacted: - be.atbash.ee.security:totp-web =0.5, =3.2.1036, =1.0.0, =1.0.4, =0.1.0, =0.1.0, =0.8.0, =2.0.0, =0.13, =0.15.1...

GHSA-FW5F-7C6C-3VMV Cross-site Scripting in PrimeFaces

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

Cross-site Scripting in PrimeFaces

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

VulnCheck KEV: CVE-2017-1000486

Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution...

U.S. Dept Of Defense: RCE in ██████ subdomain via CVE-2017-1000486

Summary: The application at ████████/ftn-Website/ uses primefaces 5.3 but not 5.3.8, making it vulnerable to unauthenticated RCE CVE-2017-1000486. Step-by-step Reproduction Instructions 1. Get the publicly available POC for this vulnerability here: https://github.com/pimps/CVE-2017-1000486 2...

U.S. Dept Of Defense: RCE (Remote code execution) in one of DoD's websites

Summary: The targeted website is vulnerable to CVE-2017-1000486, by only running command was whoami to prove that the RCE exist has been run successfully on the target Description: The target uses a vulnerable version of primefaces : Primetek Primefaces 5.x, that is vulnerable to a weak encryptio...

Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution

Exploit Title: Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution Date: 2020-04-24 Vendor Homepage: https://www.tecnoredsa.com.ar Exploit Authors: LiquidWorm Software Link: https://dl.getpopcorntime.is/PopcornTime-latest.exe Version: 2.8.1 CVE : N/A !/usr/bin/env python3 -- coding: utf-8...

Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution Exploit

Exploit for java platform in category web applications Exploit Title: Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution Vendor Homepage: https://www.tecnoredsa.com.ar Exploit Authors: LiquidWorm Software Link: https://dl.getpopcorntime.is/PopcornTime-latest.exe Version: 2.8.1 CVE : N/A...

Furukawa Electric ConsciusMAP 2.8.1 Java Deserialization Remote Code Execution

Summary Apros Evoluation / Furukawa / ConsciusMap is the Tecnored provisioning system for FTTH networks. Complete administration of your entire external FTTH network plant, including from the ONUs installed in each end customer, to the wiring and junction boxes. Unify all the management of your...

PrimeTek PrimeFaces Cross-Site Scripting Vulnerability

Primetek Primefaces is an open source use in the Java EE system UI library . A cross-site scripting vulnerability in the tooltip/tooltip.js file in PrimeTek PrimeFaces version 7.0.11, which stems from a lack of proper validation of client-side data in a WEB application, can be exploited by an...

CVE-2020-10544

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

CVE-2020-10544

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

Input validation

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

CVE-2020-10544

PrimeFaces 7.0.11 (PrimeTek) has an XSS vulnerability in tooltip.js where user-supplied data used as a tooltip title can inject JavaScript due to lack of input validation. Affected component: tooltip functionality in PrimeFaces web applications. Root cause: input data used for tooltip titles is n...