Cross-site Scripting (XSS)

Apache Sling XSS is vulnerable to cross-site scripting XSS attacks. The application does not properly encode or escape URLs, allowing a malicious user to inject and execute arbitrary Javascript...

Unspecified Vulnerability in Apache Sling JCR ContentLoader XmlReader

Apache Sling JCR ContentLoader is the United States Apache Apache Software Foundation for the Java platform for a set of open source Web framework. The framework can be in the JCR Content Repository Java Content Repository on the creation of content-oriented applications . XmlReader is one of the...

CVE-2017-15717

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...

Code injection

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...

CVE-2017-15717

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...

CVE-2017-15717

CVE-2017-15717 involves a flaw in URL escaping/encoding in the Apache Sling XSS Protection API. The issue resides in org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref, allowing specially crafted URLs to pass as valid despite carrying XSS pay...

CVE-2017-15717

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...

Information Disclosure

Apache Sling JCR ContentLoader is vulnerable to information disclosure. The application doesn't properly check if a directory exists before importing files, allowing a malicious user access to arbitrary files...

CVE-2012-3353

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader...

Design/Logic Flaw

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader...

CVE-2012-3353

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader...

CVE-2012-3353

The CVE-2012-3353 entry concerns Apache Sling JCR ContentLoader’s XmlReader in version 2.1.4, which allows importing arbitrary files (including local files) into the content repository, enabling potential information disclosure. The vulnerability arises from how XmlReader handles import operation...

Unvalidated Redirection Attack

org.apache.sling.auth.core is vulnerable to unvalidated redirection attacks. The vulnerability exists due to the lack validation of user input from the Sling login form which allows an attacker to send victims credentials...

Apache Sling Authentication Service Credential Leakage Vulnerability

Apache Sling is the United States Apache Apache Software Foundation for the Java platform for a set of open source Web framework. The framework can be created in the JCR content repository Java Content Repository on the content-oriented applications . Authentication Service is one of the...

Design/Logic Flaw

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

CVE-2017-15700

The provided connected documents identify CVE-2017-15700 as a flaw in Apache Sling Authentication Service (version 1.4.0) related to the AuthUtil#isRedirectValid method. The root cause is flawed redirect validation, which can be exploited via the Sling login form to trick a victim into sending cr...

CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

Cross site scripting

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. A cross-site scripting vulnerability in Apache Sling Servlets Post 2.3.20 has been resolved in Adobe Experience Manager...