CVE-2022-32549 log injection in Sling logging

Apache Sling Commons Log = 5.4.0 and Apache Sling API = 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files...

Apache Sling 安全漏洞

Apache Sling is an open source Web framework for the Java platform from the Apache Foundation. Designed to create content-centric applications on JSR-170-compliant content repositories such as Apache Jackrabbit, a log injection vulnerability exists in Apache Sling Commons Log version 5.4.0 and...

Apache Sling POST Servlets Denial of Service Vulnerability

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

com.activecq.tools.quickimage:core (=1.0.0), com.adobe.cq.commerce:cq-commerce-hybris-impl (>=5.5.0 <=6.4.4) +19 more potentially affected by CVE-2012-2138 via org.apache.sling:org.apache.sling.servlets.post (>=2.0.4-incubator <=2.1.0)

org.apache.sling:org.apache.sling.servlets.post MAVEN version =2.0.4-incubator, =5.5.0, =5.5.0, =5.3.0, =5.3.0, =5.4.0, =1.0.8, =1.0.12, =1.0.6, =5.5.0, =5.6.2, =5.4.0, =5.6.8 and more Source cves: CVE-2012-2138 Source advisory: OSV:GHSA-342C-F869-5M44...

GHSA-342C-F869-5M44 Apache Sling POST Servlets Denial of Service Vulnerability

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

com.adobe.granite:com.adobe.granite.auth.oauth (>=0.0.12 <=1.0.0-R201304291556), com.adobe.granite:com.adobe.granite.auth.saml (>=0.1.14 <=0.2.2) +16 more potentially affected by CVE-2013-4390 via org.apache.sling:org.apache.sling.auth.core (>=1.0.0 <=1.1.0)

org.apache.sling:org.apache.sling.auth.core MAVEN version =1.0.0, =0.0.12, =0.1.14, =0.0.2, =1.0.0, =1.0.12, =1.0.12, =1.0.18, =5.4.0, =0.1.0, =2.2.0, =0.6.0, =1.0.0, =2.1.0, =1.1.0, =1.2.8 and more Source cves: CVE-2013-4390 Source advisory: OSV:GHSA-J7F2-CQVQ-5JCF...

Apache Sling Auth Core bundle vulnerable to Open Redirection

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core org.apache.sling.auth.core bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a...

GHSA-J7F2-CQVQ-5JCF Apache Sling Auth Core bundle vulnerable to Open Redirection

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core org.apache.sling.auth.core bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a...

net.adamcin.recap:net.adamcin.recap.addressbook (>=0.8.0 <=1.0.1), net.adamcin.recap:net.adamcin.recap.core (>=0.8.0 <=1.0.1) +16 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.4.0 <=2.4.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.4.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.1.0, =2.1.2, =5.12.0, =5.11.0, =5.12.2 and more Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

org.apache.sling:org.apache.sling.caconfig.impl (>=1.2.0 <=1.6.0), org.apache.sling:org.apache.sling.scripting.sightly (>=1.0.0 <=1.0.32) +1 more potentially affected by CVE-2016-6798 via org.apache.sling:org.apache.sling.xss (=1.0.0)

org.apache.sling:org.apache.sling.xss MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.sling:org.apache.sling.xss and may be impacted: - org.apache.sling:org.apache.sling.caconfig.impl =1.2.0, =1.0.0, =1.0.0, =1.0.2 Sourc...

XML External Entity Reference in Apache Sling

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

GHSA-7G54-VGP6-JJ5W XML External Entity Reference in Apache Sling

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...

Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers ...

be.orbinson.aem:aemaacs-opentelemetry-instrumentation.core (=1.2.0), biz.netcentric.cq.tools.accesscontroltool:accesscontroltool-bundle (>=1.2.8 <=4.2.1) +604 more potentially affected by CVE-2013-2254 via org.apache.sling:org.apache.sling.api (>=2.0.2-incubator <=2.3.0)

org.apache.sling:org.apache.sling.api MAVEN version =2.0.2-incubator, =1.2.8, =2.5.4, =3.0.0, =4.2.0, =1.0.0, =1.0.0, =0.1.1, =1.0.1, =3.1.1, =3.1.1, =0.0.1, =0.0.8 - com.adobe.aem.commons:assetshare.ui.apps =1.9.6 - com.adobe.aem.commons:assetshare.ui.content =1.9.6 and more Source cves:...

GHSA-CXWH-VMHG-39R2 Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers ...

Apache Sling Authentication Service vulnerability

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

GHSA-VCVP-89FQ-HWJ8 Apache Sling Authentication Service vulnerability

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

com.adobe.aem.addon.guides:aem-guides-it-tests (>=0.0.1 <=0.0.2), com.adobe.aem.guides:aem-cif-guides-venia.it.tests (>=2012.12.01 <=2024.10.07) +44 more potentially affected by CVE-2017-15717 via org.apache.sling:org.apache.sling.xss (>=1.0.4 <=2.0.12)

org.apache.sling:org.apache.sling.xss MAVEN version =1.0.4, =0.0.1, =2012.12.01, =0.0.4, =0.1.0, =0.2.6, =2.17.0, =2.18.0, =2.17.10, =0.1.0, =0.1.0, =1.0.0, =0.2.1, =0.9.2 and more Source cves: CVE-2017-15717 Source advisory: OSV:GHSA-7MFW-43C4-45MQ...

Cross-site Scripting in Apache Sling XSS Protection API

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...

GHSA-7MFW-43C4-45MQ Cross-site Scripting in Apache Sling XSS Protection API

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...