VUL4J-23

Apache Sling ¡Recuperando la diversión! Apache Sling es un framework web que utiliza un repositorio de contenido Java, como Apache Jackrabbit, para almacenar y gestionar contenido. Las aplicaciones de Sling utilizan scripts o servlets Java, seleccionados según convenciones simples de nombres, par...

Deserialization Of Untrusted Data

Apache Jackrabbit Core and Apache Jackrabbit JCR Commons are vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the acceptance of untrusted JNDI URIs for JCR lookup, which allows an attacker to inject malicious JNDI references that trigger deserialization of untrusted...

EUVD-2015-1992

Malware in sbrugna...

EUVD-2013-6537

Malware in sbrugna...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JCR lookup functionality. An attacker can execute arbitrary code by injecting malicious JNDI references that are deserialized when untrusted JNDI URIs are accepted. JNDI URIs are can be...

CrafterCMS 安全漏洞

CrafterCMS is a Java-based CMS from CrafterCMS, Inc. A security vulnerability exists in CrafterCMS versions 4.0.0 through 4.2.2 that stems from a Groovy sandbox bypass resulting in OS commands that can be executed by certified developers...

UJCMS 代码注入漏洞

UJCMS is a Java open source content management system from dromara open source. A code injection vulnerability exists in UJCMS version 9.7.5, which originates from cross-site scripting of the uploadZip/upload function in the File Upload component and could lead to a remote attack...

UJCMS 安全漏洞

UJCMS is a Java open source content management system from dromara open source. A security vulnerability exists in UJCMS version 9.6.3, which stems from insufficient cleanup of embedded attributes in uploaded SVG files, and a stored Cross-Site Scripting XSS vulnerability that could allow an...

Adobe InDesign 跨站脚本漏洞

Adobe Acs-aem-commons is a Java-based codebase for AEM/CQ code collections generated according to AEM by Adobe in the United States. A security vulnerability exists in Adobe ACS Commons that stems from a failure to properly handle invalid JCR characters, which can be exploited by an attacker to...

CVE-2021-21043

ACS Commons version 4.9.2 and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content...

Unspecified Vulnerability in Apache Sling JCR ContentLoader XmlReader

Apache Sling JCR ContentLoader is the United States Apache Apache Software Foundation for the Java platform for a set of open source Web framework. The framework can be in the JCR Content Repository Java Content Repository on the creation of content-oriented applications . XmlReader is one of the...

JEECMS Resource Module Exploits Arbitrary File Upload Vulnerability

JEECMS is the domestic Java version of the open source web content management system java cms, jsp cms for short. JEECMS product background a function exists in an arbitrary file upload vulnerability. Allow attackers to take advantage of the vulnerability to upload arbitrary files...

The vulnerability of the application interface of IBM WebSphere Portal servers allows a hacker to gain access to the protected Java Content Repository.

The vulnerability of the application interface of IBM WebSphere Portal servers relates to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the protected Java Content Repository through a specially crafted...

CVE-2015-1887

IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository JCR information via a crafted request...

PT-2015-1646

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0.0 through 7.0.0.2 CF29 IBM WebSphere Portal versions 8.0.0 through 8.0.0 before 8.0.0.1 CF17 IBM WebSphere Portal versions 8.5.0 through 8.5.0 before CF06 Description The issue allows remote attackers to obtai...

CVE-2013-6735

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository JCR information via a modified Web...

Code injection

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository JCR information via a modified Web...

CVE-2013-6735

CVE-2013-6735 affects IBM Web Content Manager (WCM). The connected sources confirm an XPath-injection vulnerability in WCM LIBRARY parameter that allows an unauthenticated attacker to manipulate requests and potentially extract sensitive configuration/JCR data from vulnerable WCM installations (v...

Oracle Linux 4 / 6 : thunderbird (ELSA-2011-0374)

From Red Hat Security Advisory 2011:0374 : An updated thunderbird package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. Mozilla Thunderbird is a...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x, SL6.x i386/x86_64

This erratum blacklists a small number of HTTPS certificates. BZ689430 This update also fixes the following bug : - Previous security updates introduced a regression, preventing some Java content and plug-ins written in Java from loading. With this update, the Java content and plug-ins work as...