CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

CVE-2017-15700

The provided connected documents identify CVE-2017-15700 as a flaw in Apache Sling Authentication Service (version 1.4.0) related to the AuthUtil#isRedirectValid method. The root cause is flawed redirect validation, which can be exploited via the Sling login form to trick a victim into sending cr...

CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

Cross site scripting

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. A cross-site scripting vulnerability in Apache Sling Servlets Post 2.3.20 has been resolved in Adobe Experience Manager...

CVE-2017-11296

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. A cross-site scripting vulnerability in Apache Sling Servlets Post 2.3.20 has been resolved in Adobe Experience Manager...

CVE-2017-11296

CVE-2017-11296 affects Adobe Experience Manager 6.0–6.3 via a cross-site scripting vulnerability in Apache Sling Servlets Post 2.3.20. The root cause is improper input handling in that component, allowing a browser-based XSS attack. The vulnerability has been resolved in AEM; exploitation status ...

Apache Sling Servlets Post Cross-Site Scripting Vulnerability (CNVD-2017-37560)

Adobe Experience Manager AEM is the United States of America Ordoby Adobe can be used to build a set of web sites, mobile applications and forms of content management solutions. The program supports mobile content management, marketing and sales campaign management and multi-site management , etc...

Apache Sling Servlets Post 2.3.20 Cross Site Scripting Vulnerability

Exploit for multiple platform in category remote exploits CVE-2017-9802: Apache Sling XSS vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Sling Servlets Post 2.3.20 Description: The Javascript method Sling.evalString uses the javascript eval...

Apache Sling Servlets Post Cross-Site Scripting Vulnerability

Apache Sling API is the United States Apache Apache Software Foundation's set of frameworks for building Web applications. Apache Sling Servlets Post is one of the container. A security vulnerability exists in the Javascript method Sling.evalString in Apache Sling Servlets Post versions prior to...

Cross-site Scripting (XSS)

Apache Sling Servlets Post is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the Sling.evalString function in sling.js doesn't correctly parse input strings...

CVE-2017-9802

The Javascript method Sling.evalString in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings...

CVE-2017-9802

The Javascript method Sling.evalString in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings...

CVE-2017-9802

The Javascript method Sling.evalString in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings...

CVE-2017-9802

CVE-2017-9802 affects Apache Sling Servlets Post prior to version 2.3.22. The vulnerability arises from using the Javascript function eval on input strings in Sling.evalString(), enabling cross-site scripting (XSS). Impact is XSS through crafted input strings; affected version is 2.3.20 (and olde...

Apache Sling API Cross-Site Scripting Vulnerability

Apache Sling is a set of U.S. Apache Software Foundation for the Java platform on the open source Web framework. A cross-site scripting vulnerability in the XSS Protection API module in Apache Sling allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, whic...

Apache Sling XSS Protection API XML External Entity Injection Vulnerability

Apache Sling is the United States Apache Apache Software Foundation for the Java platform for a set of open source Web framework. The framework can be in the JCR content repository Java Content Repository to create content-oriented applications . XSS Protection API module is one of the XSS attack...

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...