CVE-2022-42466

Apache Isis prior to version 2.0.0-M9 is affected by a cross-site scripting vulnerability caused by input strings not being escaped when rendered, allowing injected scripts to execute. The issue is addressed in 2.0.0-M9 and later by escaping input strings during rendering. Affected products inclu...

CVE-2022-42467

Summary of affected component: Apache Isis h2 webconsole module in prototype mode. Vulnerability mechanism: The webconsole is automatically available in prototype mode, enabling direct database queries; safeguards require explicit enablement via configuration. Root cause/mitigation details: Since...