80 matches found
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The library does not properly escape cfg.promptLabel, item.children'span'.text, input.next.text and input.val, found in forms.password.js, forms.multiselectlistbox.js, and forms.selectcheckboxmenu.js respectively. These improper...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The library does not properly escape the headerText and footerText variables in the UIColumn, allowing a malicious user to inject and execute arbitrary Javascript...
Cross-Site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape the option parameter, allowing a malicious user to inject and execute arbitrary Javascript...
Cross-site Scripting (XSS)
PrimeFaces is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the p:colorPicker variable, allowing a malicious user to inject arbitrary CSS...
Cross-Site Scripting (XSS)
The primefaces library is vulnerable to cross-site scripting XSS attacks through the href and target attributes of ButtonRenderer. Malicious code that is returned in the Content-Type: text/javascript context can result in that code executing within the target user's browser session...
Primefaces 5.x - Remote Code Execution (Metasploit)
Primefaces 5.x - Remote Code Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2017-1000486 Primefaces Remote Code Execution Exploit', 'Description' = %q This module...
Primefaces 5.x Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2017-1000486 Primefaces Remote Code Execution Exploit', 'Description' = %q This module exploits an expression language remote code execution...
Primefaces 5.x - Remote Code Execution Exploit
Exploit for java platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2017-1000486 Primefaces Remote Code Execution Exploit', 'Description' = %q This module...
Primefaces 5.x - Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2017-1000486 Primefaces Remote Code Execution Exploit', 'Description' = %q This module exploits an expression language remote code execution...
Primetek Primefaces Remote Code Execution Vulnerability
Primetek Primefaces is an open source use in the Java EE system UI library . A remote code execution vulnerability exists in version 5.x of Primetek Primefaces. A remote attacker could exploit this vulnerability to execute code...
Remote Code Execution (RCE)
primefaces is vulnerable to remote code execution RCE. It uses weak encryption on the PrimeSecret and PrimeOracle which allows expression language injection and remote code execution...
CVE-2017-1000486
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution...
Remote code execution
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution...
CVE-2017-1000486
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution...
CVE-2017-1000486
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution...
CVE-2017-1000486
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution...
CVE-2017-1000486
CVE-2017-1000486 affects Primetek Primefaces 5.x, with a weak encryption flaw enabling remote code execution. Public details describe a padding oracle issue exploited by attackers; Primefaces versions prior to 5.2.21, 5.3.8, or 6.0 are noted as vulnerable, with patches implied for those lines. Pu...
CVE-2017-1000486
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website
Summary: One of the DoD applications uses a java library which is vulnerable to expression language injection. Using only an URL I was able to inject java code. I made a simple PoC that requests a name resolution to a DNS server. Description: The application at https://███ uses Primefaces version...
Primefaces Remote Code Execution Exploit
This module exploits a Java Expression Language remote code execution flaw in the Primefaces JSF framework. Primefaces versions prior to 5.2.21, 5.3.8 or 6.0 are vulnerable to a padding oracle attack, due to the use of weak crypto and default encryption password and salt. Tested against Docker...