CVE-2019-0207

The CVE-2019-0207 issue involves the Tapestry framework’s asset handling, where the asset path chain StaticFilesFilter → AssetDispatcher → ContextResource fails to filter the backslash character on Windows, enabling path traversal to read arbitrary files. Affected component: Tapestry assets proce...

CVE-2019-0195

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

Deserialization of untrusted data

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

Directory Traversal

tapestry-ioc is vulnerable to directory traversal. The \ character is not filtered when the library is used on a Windows platform, allowing an attacker to perform a path traversal attack to read arbitrary files...

PT-2019-11190 · Apache · Tapestry

Name of the Vulnerable Software and Affected Versions: Tapestry affected versions not specified Description: The issue concerns a path traversal attack. Specifically, Tapestry processes assets using the /assets/ctx endpoint, which is handled by a chain of classes: StaticFilesFilter -...

Apache Tapestry 5.3.6 HMAC Timing Attack Vulnerability

Exploit for java platform in category web applications CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry Affected versions: - Apache Tapestry 5.3.6 through current releases. Description: Apache Tapestry uses HMACs to verify the integrity of objects stored on the client side...

Tapestry - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-051

This theme provides Drupal users with many advanced features including 20 Different Color Styles, 30 User Regions, Custom Block Theme Templates, Suckerfish Menus, Icon Support, Advanced Page Layout Options, Simple Configuration, Custom Typography... The theme doesn't sufficiently sanitize user...

Apache Tapestry Denial of Service Vulnerability

Apache Tapestry is the United States Apache Apache Software Foundation developed a set of frameworks used to create Java-based Web applications. A security vulnerability exists in Apache Tapestry versions prior to 5.3.6, which arises from the program's failure to check for tampering when storing...

CVE-2014-1972

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

Code injection

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

CVE-2014-1972

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

CVE-2014-1972

Apache Tapestry prior to 5.3.6 is vulnerable due to storing objects on the client side without verifying client modifications, enabling denial of service or arbitrary code execution via crafted serialized data. Affected: Apache Tapestry versions up to 5.3.5 (and 5.3.x prior to 5.3.6). Root cause:...

Apache Tapestry deserializes untrusted data

Overview Apache Tapestry contains a vulnerability where it may deserialize untrusted data. Apache Tapestry is a framework for creating Java web applications. Apache Tapestry contains an interface where client side serialized data sent to the server is deserialized after it is received by the...

JVN#17611367: Apache Tapestry deserializes untrusted data

Apache Tapestry is a framework for creating Java web applications. Apache Tapestry contains an interface where client side serialized data sent to the server is deserialized after it is received by the server. This data serialization / deserialization process does not contain data validation...