CVE-2016-0712

CVE-2016-0712 is a cross-site scripting (XSS) vulnerability in Apache Jetspeed, reported as exploitable via the URI path (PATH_INFO) when accessing JetSpeed portals (prior to 2.3.1). The core issue is improper validation of user-supplied input in the portal path, enabling remote attackers to inje...

CVE-2016-0711

Apache Jetspeed is vulnerable to cross-site scripting via the title field when adding a link, page, or folder, due to insufficient validation of user input. A remote attacker could inject scripts into pages viewed by users, potentially executing in the browser and, per IBM advisory, may enable th...