CVE-2020-10544

PrimeFaces 7.0.11 (PrimeTek) has an XSS vulnerability in tooltip.js where user-supplied data used as a tooltip title can inject JavaScript due to lack of input validation. Affected component: tooltip functionality in PrimeFaces web applications. Root cause: input data used for tooltip titles is n...

Oracle Mojarra JSF / Eclipse Mojarra JSF 2.2 / 2.3 Cross Site Scripting Vulnerability

Exploit for java platform in category web applications ======================================================================= title: Reflected Cross-Site Scripting XSS product: Oracle Mojarra JSF included in Java EE 7 Eclipse Mojarra JSF vulnerable version: 2.2 & 2.3 fixed version:...

Oracle Mojarra JSF / Eclipse Mojarra JSF 2.2 / 2.3 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Reflected Cross-Site Scripting XSS product: Oracle Mojarra JSF included in Java EE 7 Eclipse Mojarra JSF vulnerable version: 2.2 & 2.3 fixed version:...

Cross-site Scripting (XSS)

PrimeFaces is vulnerable to cross-site scripting XSS. The vulnerability exists due to the lack of validation for the parameter inputTextarea.getMaxlength on the server side, allowing an attacker to inject arbitrary Javascript into a victim's browser through the affected parameter...

HPE Intelligent Management Center (IMC) PrimeFaces Expression Language Injection Remote Code Execution Vulnerability

HPE Intelligent Management Center IMC is a comprehensive management platform built from the ground up to support the Failure, Configuration, Accounting, Performance and Security FCAPS model. A PrimeFaces expression language injection remote code execution vulnerability exists in HPE Intelligent...

(0Day) Hewlett Packard Enterprise Intelligent Management Center PrimeFaces Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PrimeFaces endpoint. When parsing the...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of o.timeOnlyTitle, allowing XSS attacks...

Cross-Site Scripting (XSS)

PrimeFaces Extensions is vulnerable to cross-site scripting XSS. The vulnerability is possible because it fails to validate the input parameters in the triStateManyCheckbox function...

Primetek Primefaces Weak Encryption Remote Code Execution (CVE-2017-1000486)

Primefaces versions prior to 5.2.21, 5.3.8 or 6.0 are vulnerable to a padding oracle attack, due to the use of weak crypto and default encryption password...

Cross-site Scripting (XSS)

primefaces-extensions is vulnerable to cross-site scripting XSS attacks. The library does not escape the string input when setting the menuItem label, allowing a malicious user to inject and execute arbitrary Javascript...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the filename when a file is uploaded, allowing a malicious user to inject and execute arbitrary Javascript...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of msg in core.dialog.js...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of user sanitization of the value of summary in the fileUpload functionality...

Cross-Site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS. The attack is possible because the application does not perform enough sanitization on the following attributes: stateOneTitle, stateTwoTitle, stateThreeTitle in TriStateCheckboxRenderer.java...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the href value when rendered through printer.js, allowing XSS attacks to occur...

Cross-Site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS. The attack exists because it does not have adequate sanitization for the user input in PrimeFaces.escapeHTML function...

pro.primefaces.org XSS vulnerability

Open Bug Bounty ID: OBB-609289 Description| Value ---|--- Affected Website:| pro.primefaces.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross-site Scripting (XSS)

primefaces is vulnerable to multiple cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization for the values of the following views: tabView, carousel, dataGrid, dataList, pickList, commandButton...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of param values under non-AJAX implementations of AbstractMenu such as in BaseMenuRenderer...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the paramValue variable found in AjaxRequestBuilder, allowing malicious scripts to be executed when the values are displayed...