GHSA-C69W-JJ56-834W Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Apache Sling Commons Messaging Mail

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549 SMTPS server hostname not checked when making TLS connection to SMTPS server

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549

CVE-2021-44549 affects Apache Sling Commons Messaging Mail (Sling Mail) implementations that use SMTPS. The issue arises from the SimpleMailService in Apache Sling Commons Messaging Mail 1.0 which lacked an option to enable mail.smtps.ssl.checkserveridentity by default, leaving SMTPS connections ...

Apache Sling Commons Messaging Mail 信任管理问题漏洞

Apache Sling Commons Messaging Mail is an open source messaging mail service from the Apache Foundation in the U.S. A trust management issue vulnerability exists in Apache Sling Commons Messaging Mail 1.0.0, which stems from the Apache Sling Commons Messaging Mail provides a simple layer on top o...

Apache Sling CMS Cross-Site Scripting Vulnerability

Apache Sling CMS is an intuitive, full-featured content management system. A reflected cross-site scripting vulnerability exists in Apache Sling CMS versions prior to 0.16.0. The vulnerability stems from a script in Sling CMS that does not escape the URL's Sling Selector when generating navigatio...

CVE-2020-1949

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks...

CVE-2020-1949

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks...

Cross site scripting

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks...

CVE-2020-1949

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks...

CVE-2020-1949

CVE-2020-1949 affects Sling CMS versions before 0.16.0. The root cause is improper escaping of the Sling Selector in URLs when generating navigation elements in the administrative console, enabling reflected XSS. Exploitation details or in-the-wild data are not provided in the supplied documents....

Cross-site Scripting (XSS)

Apache Sling is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize appenderName in the function renderAppenderContent of SlingLogPanel, allowing a remote attacker to inject arbitrary Javascript into a victim's browser...

Adobe Enterprise Manager (AEM) 6.3 - Remote Code Execution Exploit

Exploit for jsp platform in category web applications Exploit Title: Adobe Experience Manager AEM 6.3 default credentials leads to RCE Exploit Author: StaticFlow Vendor Homepage: https://www.adobe.com/in/marketing-cloud/experience-manager.html Version: 6.3 import requests import sys baseUrl =...

CVE-2018-4876

Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPIgetValidHref function...

Cross site scripting

Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPIgetValidHref function...

CVE-2018-4876

Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPIgetValidHref function...

CVE-2018-4876

CVE-2018-4876 affects Adobe Experience Manager 6.1–6.3. The vulnerability is a cross-site scripting flaw caused by a bypass of the Sling XSSAPI#getValidHref function, enabling an attacker to obtain sensitive information. Adobe’s advisory APSB18-04 confirms security updates addressing CVE-2018-487...

CVE-2018-4876

Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPIgetValidHref function...

APSB18-04 Security updates available for Adobe Experience Manager

Adobe has released security updates for Adobe Experience Manager. These updates resolve a reflected cross-site scripting vulnerability CVE-2018-4875 rated moderate, and a cross-site scripting vulnerability CVE-2018-4876 in Apache Sling XSS protection API rated important...