Path Traversal

org.apache.sling: org.apache.sling.servlets.resolver is vulnerable to Path Traversal. The vulnerability is due to the findScript function within SlingScriptResolverImpl.java allowing user-supplied paths without any validation and the resolveServletInternal function within SlingServletResolver.jav...

Log Injection

org.apache.sling:org.apache.sling.api and org.apache.sling:org.apache.sling.commons.log is vulnerable to log injection. A remote attacker with privileges to forge logs, is able to inject fake logs and potentially corrupt log files, causing unintended behavior in the the system...

Man In The Middle (MitM)

org.apache.sling:org.apache.sling.commons.messaging.mail is vulnerable to man-in-the-middle MitM attacks. Lack of server identity checks when accessing mail servers allow remote attackers to perform man in the middle attacks when participating in a shared mail session...