Cross site scripting

Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...

PT-2015-3439

Name of the Vulnerable Software and Affected Versions Java Runtime Environment versions prior to 1.8 Java Development Kit versions prior to 1.8 Description The issue is related to the implementation of the URLDecoder class in Java Runtime Environment and Java Development Kit, specifically when...