Apache Jackrabbit q参数跨站脚本漏洞

BUGTRAQ ID: 33360 CVECAN ID: CVE-2009-0026 Apache Jackrabbit是一个完全遵守Java API版的内容存储规范（JCR）的实现。 Apache Jackrabbit的search.jsp和swr.jsp页面没有正确地过滤q参数便返回给了用户，这允许远程攻击者通过提交恶意请求执行跨站脚本攻击，在用户浏览器会话中执行任意HTML和脚本代码。 Apache Group Jackrabbit 1.5.0 Apache Group Jackrabbit 1.4 Apache Group ------------...

Apache Jackrabbit 'q' Parameter XSS

The remote host is running Apache Jackrabbit, an open source webapp that implements the Java Content Repository JCR API. The version of Apache Jackrabbit running on the remote host fails to sanitize user input to the 'q' parameter of the 'search.jsp' and 'swr.jsp' pages before including it in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

CVE-2009-0026

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

CVE-2009-0026

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

CVE-2009-0026

Summary: CVE-2009-0026 affects Apache Jackrabbit prior to 1.5.2, enabling remote XSS via the q parameter to search.jsp and swr.jsp in the webapp. The root cause is improper escaping/validation of user input in these endpoints, allowing injection of arbitrary HTML/JavaScript into a user’s browser....

PT-2009-2741 · Apache · Apache Jackrabbit

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions prior to 1.5.2 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the ...

Apache JackRabbit 1.4/1.5 Content Repository (JCR) - 'search.jsp?q' Cross-Site Scripting

source: https://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting...

Apache JackRabbit 1.41.5 Content Repository (JCR) - swr.jsp?q Cross-Site Scripting

Apache JackRabbit 1.41.5 Content Repository JCR - swr.jsp?q Cross-Site Scripting source: https://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage...

Apache JackRabbit 1.41.5 Content Repository (JCR) - search.jsp?q Cross-Site Scripting

Apache JackRabbit 1.41.5 Content Repository JCR - search.jsp?q Cross-Site Scripting source: https://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may levera...

[Full-disclosure] [ANNOUNCE] Apache Jackrabbit 1.5.2 released

The Apache Jackrabbit community is pleased to announce the release of Apache Jackrabbit version 1.5.2. The release is available for download at: http://jackrabbit.apache.org/downloads.html See the full release notes below for details about this release. Release Notes -- Apache Jackrabbit -- Versi...

Apache JackRabbit 1.4/1.5 Content Repository (JCR) - 'swr.jsp?q' Cross-Site Scripting

source: https://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting...