CVE-2022-32533

CVE-2022-32533 affects Apache Jetspeed-2. The connected Red Hat, CNVD, PRION, CVE lists describe an input-validation flaw where untrusted input is not sufficiently filtered by default, enabling XSS, CSRF, SSRF and XXE-type issues. A mitigation mentioned across sources is to enable xss.filter.post...

Apache Jetspeed-2 security vulnerabilities

Apache Jetspeed-2 is a very open and customizable portal platform from the Apache USA Foundation. Apache Jetspeed-2 suffers from an input validation error vulnerability that stems from Apache Jetspeed-2 failing to adequately filter untrusted user input by default, which can be exploited by an...

CVE-2022-32533: Improper Neutralization of Input During Web Page Generation

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no...

PT-2022-21354 · Apache · Apache Jetspeed-2

Name of the Vulnerable Software and Affected Versions: Apache Jetspeed-2 affected versions not specified Description: The issue arises from insufficient filtering of untrusted user input by default, leading to problems such as XSS, CSRF, XXE, and SSRF. Setting the configuration option...

com.chenlb.mmseg4j:mmseg4j-all (1.8.6), com.chenlb.mmseg4j:mmseg4j-all-with-dic (1.8.6) +22 more potentially affected by CVE-2013-6407 via org.apache.solr:solr-core (3.1.0)

org.apache.solr:solr-core MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.chenlb.mmseg4j:mmseg4j-all 1.8.6 - com.chenlb.mmseg4j:mmseg4j-all-with-dic 1.8.6 -...

GHSA-5PGM-9G57-3WC7 Apache Jetspeed vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a 1 link, 2 page, or 3 folder resource...

GHSA-W47P-5Q88-HJ5G Path Traversal in Apache Jetspeed

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...

GHSA-88F6-79X2-XQF3 Apache Jetspeed vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:jetspeed-archetype (>=2.2.1, <=2.3.0) +1 more potentially affected by CVE-2016-0710 via org.apache.portals.jetspeed-2:jetspeed (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed MAVEN version =2.1.3, =2.1.3, =2.2.1, =2.2.2, =2.3.0 Source cves: CVE-2016-0710 Source advisory: OSV:GHSA-88F6-79X2-XQF3...

Path Traversal in Apache Jetspeed

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...

Apache Jetspeed vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:jetspeed-archetype (>=2.2.1, <=2.3.0) +1 more potentially affected by CVE-2016-0710 via org.apache.portals.jetspeed-2:jetspeed (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed MAVEN version =2.1.3, =2.1.3, =2.2.1, =2.2.2, =2.3.0 Source cves: CVE-2016-0710 Source advisory: GHSA-88F6-79X2-XQF3...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:jetspeed-archetype (>=2.2.1, <=2.3.0) +1 more potentially affected by CVE-2016-0709 via org.apache.portals.jetspeed-2:jetspeed (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed MAVEN version =2.1.3, =2.1.3, =2.2.1, =2.2.2, =2.3.0 Source cves: CVE-2016-0709 Source advisory: GHSA-W47P-5Q88-HJ5G...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:applications (>=2.1.3, <=2.1.4) +35 more potentially affected by CVE-2016-0711 via org.apache.portals.jetspeed-2:jetspeed-commons (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed-commons MAVEN version =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.2.1, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.3.0 and more Source cves: CVE-2016-0711 Source advisory: GHSA-5PGM-9G57-3WC7...

Apache Jetspeed vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a 1 link, 2 page, or 3 folder resource...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:applications (>=2.1.3, <=2.1.4) +35 more potentially affected by CVE-2016-0711 via org.apache.portals.jetspeed-2:jetspeed-commons (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed-commons MAVEN version =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.2.1, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.3.0 and more Source cves: CVE-2016-0711 Source advisory: OSV:GHSA-5PGM-9G57-3WC7...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:jetspeed-archetype (>=2.2.1, <=2.3.0) +1 more potentially affected by CVE-2016-0709 via org.apache.portals.jetspeed-2:jetspeed (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed MAVEN version =2.1.3, =2.1.3, =2.2.1, =2.2.2, =2.3.0 Source cves: CVE-2016-0709 Source advisory: OSV:GHSA-W47P-5Q88-HJ5G...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:jetspeed-archetype (>=2.2.1, <=2.3.0) +1 more potentially affected by CVE-2016-0712 via org.apache.portals.jetspeed-2:jetspeed (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed MAVEN version =2.1.3, =2.1.3, =2.2.1, =2.2.2, =2.3.0 Source cves: CVE-2016-0712 Source advisory: OSV:GHSA-HJ2V-85PH-8G48...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3, <=2.1.4), org.apache.portals.jetspeed-2:jetspeed-archetype (>=2.2.1, <=2.3.0) +1 more potentially affected by CVE-2016-0712 via org.apache.portals.jetspeed-2:jetspeed (>=2.1.3, <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed MAVEN version =2.1.3, =2.1.3, =2.2.1, =2.2.2, =2.3.0 Source cves: CVE-2016-0712 Source advisory: GHSA-HJ2V-85PH-8G48...

GHSA-HJ2V-85PH-8G48 Cross-site Scripting in Apache Jetspeed

Cross-site scripting XSS vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to portal...