JVN#61328139: Apache Sling API and Servlets Post components vulnerable to cross-site scripting

Apache Sling is an open source web application framework provided by The Apache Software Foundation. Sling API and Servlet Post components included in Apache Sling contain a cross-site scripting vulnerability CWE-79 in the error page and the generation of the job completion. Impact An arbitrary...

Apache Jackrabbit WebDAV XXE Exploit

Exploit for java platform in category web applications !/usr/bin/env python """ Exploit Title: Jackrabbit WebDAV XXE Date: 25-05-2015 Software Link: http://jackrabbit.apache.org/jcr/ Exploit Author: Mikhail Egorov Contact: 0ang3el gmail com Website: http://0ang3el.blogspot.com CVE: CVE-2015-1833...

CVE-2013-4390

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core org.apache.sling.auth.core bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a...

Open redirect

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core org.apache.sling.auth.core bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a...

CVE-2013-4390

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core org.apache.sling.auth.core bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a...

CVE-2013-4390

The CVE-2013-4390 vulnerability affects the Apache Sling Auth Core bundle (org.apache.sling.auth.core) in the AbstractAuthenticationFormServlet, with versions prior to 1.1.4. An open redirect exists that lets remote attackers redirect users to arbitrary sites via a resource parameter, enabling ph...

CVE-2013-4390

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core org.apache.sling.auth.core bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a...

PT-2013-4992

Name of the Vulnerable Software and Affected Versions Apache Sling Auth Core bundle versions prior to 1.1.4 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter. This is related to a custom login fo...

CVE-2013-4390: Improper Input Validation

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core org.apache.sling.auth.core bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a...

CVE-2013-2254

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers ...

Code injection

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers ...

CVE-2013-2254

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers ...

CVE-2013-2254

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers ...

CVE-2013-2254

CVE-2013-2254 affects Apache Sling’s org.apache.sling.servlets.post.bundle in deepGetOrCreateNode (AbstractCreateOperation.java). The root cause is improper handling of a NULL value when the session lacks permissions to the root node, enabling remote denial of service via an infinite loop in Slin...

PT-2013-3625

Name of the Vulnerable Software and Affected Versions Apache Sling org.apache.sling.servlets.post.bundle versions 2.2.0 through 2.3.0 Description The issue arises from the deepGetOrCreateNode function in AbstractCreateOperation.java, which fails to handle a NULL value returned when the session...

CVE-2013-2254: Improper Restriction of Operations within the Bounds of a Memory Buffer

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers ...

[SECURITY] CVE-2012-2138 Apache Sling denial of service vulnerability

CVE-2012-2138 : Apache Sling denial of service vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: org.apache.sling.servlets.post bundle up to 2.1.0 Description: The @CopyFrom operation of the Sling POST servlet allows for copying a parent node to one of it...

Apache Sling 2.1.0 Denial Of Service

Exploit for windows platform in category dos / poc CVE-2012-2138 : Apache Sling denial of service vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: org.apache.sling.servlets.post bundle up to 2.1.0 Description: The @CopyFrom operation of the Sling POST...

Apache Sling @CopyFrom拒绝服务漏洞

CVE ID: CVE-2012-2138 Apache Sling是Java平台上的开源Web框架，在JCR内容库上创建面向内容的应用。 Apache Sling 2.1.2之前版本在处理Sling POST程序内的@CopyFrom操作时存在输入验证错误，通过特制的HTTP请求，可被利用造成无限循环和消耗内存和存储资源 0 Apache Group Sling 2.x 厂商补丁： Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://httpd.apache.org/...

CVE-2012-2138

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...