CVE-2024-23673 Apache Sling Servlets Resolver: Malicious code execution via path traversal

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the...

CVE-2024-23673 Apache Sling Servlets Resolver: Malicious code execution via path traversal

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the...

Apache Sling 路径遍历漏洞

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. A path traversal vulnerability exists in Apache Sling Servlets Resolver...

Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 Multiple Vulnerabilities (APSB16-05)

The version of Adobe Experience Manager installed on the remote host is either 5.6.1, 6.0.0, or 6.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB16-05 advisory. - Adobe Experience Manager version 6.1 is affected by a cross-site scripting vulnerability that...

Apache Sling Input Validation Error Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to comply with JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. An input validation error vulnerability exists in Apache Sling Commons...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4 <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=3.0.0 <=4.2.1) +52 more potentially affected by CVE-2022-47937 via org.apache.sling:org.apache.sling.commons.json (>=2.0.2-incubator <=2.0.20)

org.apache.sling:org.apache.sling.commons.json MAVEN version =2.0.2-incubator, =2.5.4, =3.0.0, =5.5.0, =2.17.10, =0.0.10, =5.5.0, =1.0.4, =1.8.0 and more Source cves: CVE-2022-47937 Source advisory: OSV:GHSA-8J28-34QQ-GMCH...

Apache Sling Commons JSON bundle vulnerable to Improper Input Validation

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The org.apache.sling.commons.json bundle has been...

CVE-2022-47937

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to conside...

Input validation

UNSUPPORTED WHEN ASSIGNED Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. NOTE: This vulnerability only affects products that are no longer supported by the maintainer The...

CVE-2022-47937 Multiple parsing problems in the Apache Sling Commons JSON module

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to conside...

CVE-2022-47937 Multiple parsing problems in the Apache Sling Commons JSON module

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to conside...

CVE-2022-47937

CVE-2022-47937 concerns the Apache Sling Commons JSON bundle. The vulnerability arises from improper input validation in the org.apache.sling.commons.json component, allowing a network attacker to trigger unexpected errors by sending specially crafted input. The bundled library is deprecated (sin...

PT-2023-15535 · Apache · Apache Sling Commons Json

Name of the Vulnerable Software and Affected Versions: Apache Sling Commons JSON bundle affected versions not specified Description: The issue is related to improper input validation, allowing an attacker to trigger unexpected errors by supplying specially-crafted input. The...

Apache Sling 输入验证错误漏洞

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to comply with JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. An input validation error vulnerability exists in Apache Sling Commons...

Privilege Escalation

org.apache.sling:org.apache.sling.engine is vulnerable to Privilege Escalation. When an attacker is able to include a resource with specific content-type and control the include path, it allows the attacker to elevate privileges and acquire administrative power, because SlingRequestDispatcher...

Apache Sling SlingRequestDispatcher Cross-Site Scripting Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Apache Sling SlingRequestDispatcher has a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain...

GHSA-MG46-F9H5-G27X Apache Sling Engine vulnerable to cross-site scripting (XSS) that can lead to privilege escalation

The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and...

com.day.cq.collab:cq-collab-blog (=5.3.0), com.day.cq.wcm:cq-wcm-api (>=5.2.26 <=5.3.0) +19 more potentially affected by CVE-2022-45064 via org.apache.sling:org.apache.sling.engine (>=2.0.2-incubator <=2.10.2)

org.apache.sling:org.apache.sling.engine MAVEN version =2.0.2-incubator, =5.2.26, =5.2.30, =5.2.14, =5.0.0, =5.0.0, =5.4.0, =5.0.0, =5.5.8 - com.day.cq:cq-security =5.2.36 - com.day.cq:cq-tagging =5.0.0 - org.apache.sling.samples:org.apache.sling.samples.simple-demo =2.0.2-incubator and more Sour...

Apache Sling Engine vulnerable to cross-site scripting (XSS) that can lead to privilege escalation

The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and...

CVE-2022-45064

The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and...