VUL4J-23

Apache Sling 重拾乐趣！ Apache Sling 是一个 Web 框架，它使用 Java 内容仓库（例如 Apache Jackrabbit）来存储和管理内容。 Sling 应用可以使用脚本或 Java Servlet，并通过简单的命名约定来以 RESTful 方式处理 HTTP 请求。 内嵌的 Apache Felix OSGi 框架和控制台提供了一个动态运行时环境，可以在运行时加载、卸载和重新配置代码与内容包。 作为第一个专为 JSR-170 Java 内容仓库设计的 Web 框架，Sling 使得实现简单应用变得非常容易，同时为更复杂的应用提供了企业级框架。...

Deserialization Of Untrusted Data

Apache Jackrabbit Core and Apache Jackrabbit JCR Commons are vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the acceptance of untrusted JNDI URIs for JCR lookup, which allows an attacker to inject malicious JNDI references that trigger deserialization of untrusted...

EUVD-2015-1992

Malware in sbrugna...

EUVD-2013-6537

Malware in sbrugna...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JCR lookup functionality. An attacker can execute arbitrary code by injecting malicious JNDI references that are deserialized when untrusted JNDI URIs are accepted. JNDI URIs are can be...

Adobe InDesign 跨站脚本漏洞

Adobe Acs-aem-commons is a Java-based codebase for AEM/CQ code collections generated according to AEM by Adobe in the United States. A security vulnerability exists in Adobe ACS Commons that stems from a failure to properly handle invalid JCR characters, which can be exploited by an attacker to...

Unspecified Vulnerability in Apache Sling JCR ContentLoader XmlReader

Apache Sling JCR ContentLoader is the United States Apache Apache Software Foundation for the Java platform for a set of open source Web framework. The framework can be in the JCR Content Repository Java Content Repository on the creation of content-oriented applications . XmlReader is one of the...

The vulnerability of the application interface of IBM WebSphere Portal servers allows a hacker to gain access to the protected Java Content Repository.

The vulnerability of the application interface of IBM WebSphere Portal servers relates to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the protected Java Content Repository through a specially crafted...

CVE-2015-1887

IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository JCR information via a crafted request...

CVE-2013-6735

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository JCR information via a modified Web...

Code injection

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository JCR information via a modified Web...

CVE-2013-6735

CVE-2013-6735 affects IBM Web Content Manager (WCM). The connected sources confirm an XPath-injection vulnerability in WCM LIBRARY parameter that allows an unauthenticated attacker to manipulate requests and potentially extract sensitive configuration/JCR data from vulnerable WCM installations (v...