CVE-2010-4007

Oracle Mojarra uses an encrypted View State without a Message Authentication Code MAC, which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057...

Ivanti Avalanche Faces ResourceManager Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Faces Mojarra component. The issue results from the use of a vulnerable...

The vulnerability of the Faces Mojarra component in the Ivanti Avalanche mobile device management system allows a hacker to disclose protected information.

The vulnerability of the Faces Mojarra component in the Ivanti Avalanche mobile device management system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Ivanti Avalanche Faces ResourceManager Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Faces Mojarra component. The issue results from the use of a vulnerable...

PT-2024-6875

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.5 Description The issue is a path traversal affecting the Faces Mojarra component within Ivanti Avalanche. This allows a remote, unauthenticated attacker to potentially reveal sensitive information. The...

The vulnerability of the getLocalePrefix function in ResourceManager.java of the Eclipse Mojarra library, as a implementation of EE4J Eclipse for the Jakarta Faces specification, allows an attacker to gain unauthorized access to protected information.

The vulnerability of the getLocalePrefix function in the ResourceManager.java file of the Eclipse Mojarra library, as a implementation of EE4J Eclipse for the Jakarta Faces specification, is related to an incorrect restriction on the path name to the restricted directory. Exploiting this...

K000134517: Eclipse vulnerability CVE-2020-6950

Security Advisory Description Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. CVE-2020-6950 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product...

GHSA-RJHX-C9QH-QH8F Cross-site Scripting in Eclipse Mojarra

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled...

Cross-site Scripting in Eclipse Mojarra

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled...

Path Traversal in Eclipse Mojarra

Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root...

GHSA-Q388-J7CW-FF7W Path Traversal in Eclipse Mojarra

Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root...

GHSA-43Q7-Q5VP-3G68 Path Traversal in Eclipse Mojarra

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications...

Path Traversal in Eclipse Mojarra

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications...

GHSA-3M3R-82GC-53MJ Improper Neutralization of Input During Web Page Generation in Mojarra

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a 1 tag or 2 EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting XSS attacks via application-specific vectors...

Improper Neutralization of Input During Web Page Generation in Mojarra

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a 1 tag or 2 EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting XSS attacks via application-specific vectors...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center)

Summary A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementati...

Directory traversal in Eclipse Mojarra

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter...

GHSA-RPQ8-MMWH-Q9HM Directory traversal in Eclipse Mojarra

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter...

Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371

A flaw was found in Eclipse Mojarra before version 2.3.14, where it is vulnerable to a path traversal flaw via the loc parameter or the con parameter. An attacker could exploit this flaw to read arbitrary files...

OESA-2021-1229 mojarra security update

JvaServerTM Faces technology simplifies building user interfaces for JavaServer applications. Developers of various skill levels can quickly build web applications by: assembling reusable UI components in a page; connecting these components to an application data source; and wiring client-generat...