Cross site scripting

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a 1 tag or 2 EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting XSS attacks via application-specific vectors...

CVE-2013-5855

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a 1 tag or 2 EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting XSS attacks via application-specific vectors...

PT-2014-1721

Name of the Vulnerable Software and Affected Versions Oracle Mojarra versions 2.2.x through 2.2.5 Oracle Mojarra versions 2.1.x through 2.1.27 Description The issue arises from inadequate encoding when using a h:outputText tag or an EL expression after a script or style block, allowing remote...