Cross site scripting in Apache Sling

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

CVE-2016-5394

CVE-2016-5394 concerns the Apache Sling XSS Protection API. The XSSProtection API module, before version 1.0.12, uses the encoding from XSSAPI.encodeForJSString() that is not sufficiently restrictive, allowing certain input patterns to pass unencoded and potentially enable cross-site scripting. T...

PT-2017-8715

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 1.0.12 Description The issue arises from the XSS Protection API module, where the encoding performed by the XSSAPI.encodeForJSString method is not restrictive enough. This allows script tags to pass through...

CVE-2016-5394: Improper Neutralization of Input During Web Page Generation

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...