CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

Cross site scripting

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

Cross site request forgery (csrf)

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2016-5394

CVE-2016-5394 concerns the Apache Sling XSS Protection API. The XSSProtection API module, before version 1.0.12, uses the encoding from XSSAPI.encodeForJSString() that is not sufficiently restrictive, allowing certain input patterns to pass unencoded and potentially enable cross-site scripting. T...

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-6798

In Apache Sling, the XSS Protection API module is affected: versions before 1.0.12 use an insecure SAX parser in XSS.getValidXML(), enabling XML External Entity (XXE) attacks. This can allow attackers to read filesystem data, enable SSRF, perform port scanning behind a firewall, or cause DoS. Pub...

CVE-2016-6798: Improper Restriction of XML External Entity Reference

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

CVE-2016-5394: Improper Neutralization of Input During Web Page Generation

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

PT-2017-8715

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 1.0.12 Description The issue arises from the XSS Protection API module, where the encoding performed by the XSSAPI.encodeForJSString method is not restrictive enough. This allows script tags to pass through...

PT-2017-9015

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 1.0.12 Description The issue concerns the XSS Protection API module in Apache Sling, where the method XSS.getValidXML uses an insecure SAX parser to validate input strings. This allows for XXE attacks in scripts...

Cross-site Scripting (XSS)

Apache Sling XSS Protection is vulnerable cross-site scripting XSS attacks. The library does not properly encode...

XML External Entity (XXE) Processing

Apache Sling XSS protection is vulnerable to XML External Entity XXE processing attacks. The library uses an insecure SAX parser to validate strings, allowing a malicious user to read sensitive data in the filesystem, conduct port-scanning behind the firewall or execute arbitrary code...

Adobe Experience Manager Apache Sling Servlets Post Component Information Disclosure Vulnerability

Apache Sling is an open source Web framework on the Java platform , in the JCR content library to create content-oriented applications . Adobe Experience Manager AEM is the United States of America Odobe Adobe company can be used to build websites, mobile applications and forms of content...

Apache Sling Framework 2.3.6 Information Disclosure

Document Title: =============== Apache Sling Framework v2.3.6 Adobe AEM CVE-2016-0956 - Information Disclosure Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1536 Adobe Bulletin:...