Cross-site Scripting (XSS)

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getValidHref function. An attacker can execute arbitrary...

PT-2026-97253

Name of the Vulnerable Software and Affected Versions Apache Sling XSS versions prior to 2.4.12 Description Improper neutralization of input during web page generation allows for a reflected cross-site scripting XSS attack. This occurs when using the getValidHref function within the XSSAPI class,...

PT-2018-16585

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.1 through 6.3 Description The issue allows for cross-site scripting via a bypass of the Sling XSSAPIgetValidHref function. Recommendations For Adobe Experience Manager versions 6.1 through 6.3, update to a...

CVE-2018-4876: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPIgetValidHref function...

Adobe Experience Manager 'Sling XSSAPI#getValidHref' function cross-site scripting vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

PT-2018-5986

Name of the Vulnerable Software and Affected Versions: Apache Sling XSS Protection API versions 1.0.4 through 1.0.18 Apache Sling XSS Protection API Compat version 1.1.0 Apache Sling XSS Protection API version 2.0.0 Description: A flaw in the way URLs are escaped and encoded in the...

CVE-2017-15717: Improper Neutralization of Input During Web Page Generation

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...