org.apache.sling:org.apache.sling.caconfig.impl (>=1.2.0 <=1.6.0), org.apache.sling:org.apache.sling.scripting.sightly (>=1.0.0 <=1.0.32) +1 more potentially affected by CVE-2016-5394 via org.apache.sling:org.apache.sling.xss (=1.0.0)

org.apache.sling:org.apache.sling.xss MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.sling:org.apache.sling.xss and may be impacted: - org.apache.sling:org.apache.sling.caconfig.impl =1.2.0, =1.0.0, =1.0.0, =1.0.2 Sourc...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-5394

CVE-2016-5394 concerns the Apache Sling XSS Protection API. The XSSProtection API module, before version 1.0.12, uses the encoding from XSSAPI.encodeForJSString() that is not sufficiently restrictive, allowing certain input patterns to pass unencoded and potentially enable cross-site scripting. T...