152 matches found
WebLogic Server Unauthorized Access
The vulnerability of the WebLogic Server application server’s JSF component is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected data or cause service failures using the HTTP protocol...
Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)
The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework Sample Apps subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. CVE-2018-1275 - ...
CVE-2018-2935
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: JSF. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...
Design/Logic Flaw
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: JSF. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...
CVE-2018-2935
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: JSF. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...
CVE-2018-2935
CVE-2018-2935 is the Oracle WebLogic Server JSF vulnerability affecting 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. The issue allows an unauthenticated, network-accessible attacker via HTTP to compromise WebLogic Server, with human interaction required for exploitation (UI: REQUIRED). The impact i...
CVE-2018-2935: Undefined Security Weakness
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: JSF. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...
Security Bulletin: Information disclosure in WebSphere Application Server Liberty affects IBM MessageSight (CVE-2017-1583)
Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty is used by IBM MessageSight. IBM MessageSight has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-1583 DESCRIPTION: IBM WebSphere...
Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server affects IBM Emptoris Strategic Supply Management suite of products and IBM Emptoris Services Procurement (CVE-2017-1583, CVE-2011-4343)
Summary The IBM Emptoris Contract Management ,IBM Emptoris Program Management, IBM Emptoris Sourcing, IBM Emptoris Spend Analysis and IBM Emptoris Services Procurement products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issu...
Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Bluemix (CVE-2017-1583, CVE-2011-4343)
Summary There is a potential infomation disclosure vulnerability that affects the Java Server Faces JSF component used by WebSphere Application Server. There is a potential infomation disclosure vulnerability that affects the MyFaces component used by JSF in WebSphere Application Server...
Cross site scripting
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters by default, so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1...
CVE-2017-17837
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters by default, so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1...
CVE-2017-17837
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters by default, so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1...
CVE-2017-17837
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters by default, so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1...
CVE-2017-17837
CVE-2017-17837 affects the Apache DeltaSpike-JSF 1.8.0 module with a Cross‑Site Scripting (XSS) leak in how windowId is handled. The windowId is truncated after 10 characters by default, which can limit impact but still constitutes an XSS risk. A fix was released in Apache DeltaSpike 1.8.1 (delta...
CVE-2017-17837
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters by default, so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1...
CVE-2017-17837
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters by default, so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1...
PT-2018-6576
Name of the Vulnerable Software and Affected Versions: Apache DeltaSpike-JSF version 1.8.0 Description: The issue is related to a XSS injection leak in the windowId handling. By default, the windowId size gets cut off after 10 characters, which might limit the impact. A fix has been applied and...
CVE-2017-17837: Improper Neutralization of Input During Web Page Generation
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters by default, so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1...