6 matches found
CVE-2026-120421
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENTWINDOWMODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...
CVE-2026-120421
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, a reflected cross-site scripting (XSS) vulnerability exists when jakarta.faces.CLIENT_WINDOW_MODE=url is enabled. The root cause is that the client window id from the jfwid or jakarta.faces.Cli...
CVE-2026-120421 Reflected XSS via client window id in URL client window mode
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENTWINDOWMODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...
EUVD-2026-116938
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENTWINDOWMODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...
PT-2026-136995
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENT WINDOW MODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...
CVE-2026-120421: Eclipse Foundation Eclipse Mojarra: In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client…
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENTWINDOWMODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...