CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2016-6798: Improper Restriction of XML External Entity Reference

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

PT-2017-9015

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 1.0.12 Description The issue concerns the XSS Protection API module in Apache Sling, where the method XSS.getValidXML uses an insecure SAX parser to validate input strings. This allows for XXE attacks in scripts...