CVE-2014-0030

Apache Roller prior to 5.0.3 is vulnerable to XML External Entity (XXE) attacks via its XML-RPC protocol support. The issue allows an attacker to trigger XXE and read sensitive files (File Disclosure). Affected component: XML-RPC/XML processing in Roller; root cause: XXE in XML parsing. Exploitat...

CVE-2015-0249

The CVE-2015-0249 entry concerns Apache Roller versions 5.1 through 5.1.1. The vulnerability arises in the weblog page template, where remote authenticated users with weblog admin privileges can execute arbitrary Java code via a crafted Velocity Template Language (VTL). Root cause is the unsafe h...