CVE-2010-4007

Oracle Mojarra is affected by CVE-2010-4007 due to an encrypted View State without a Message Authentication Code (MAC), enabling a padding oracle attack to modify the View State remotely. This weakness is reiterated across multiple sources (NVD, Red Hat advisory, and other feeds) and is tied to M...

CVE-2010-2087

CVE-2010-2087: Oracle Mojarra 1.2_14 and 2.0.2 (as used in IBM WebSphere Application Server, Caucho Resin, and other apps) fails to properly protect an unencrypted view state. This enables remote attackers to perform cross-site scripting (XSS) or execute arbitrary Expression Language (EL) stateme...

CVE-2013-5855

CVE-2013-5855 affects Oracle Mojarra JSF. The vulnerability is an XSS due to improper encoding when a (1) tag or (2) EL expression is used after a scriptor style block, enabling remote attackers to inject script via application-specific vectors. Affected are Mojarra 2.2.x before 2.2.6 and 2.1.x ...

CVE-2012-2672

CVE-2012-2672 affects Oracle Mojarra 2.1.7. The issue arises when the FacesContext reference is not properly cleaned up during startup, leaving a ThreadLocal that can allow a JSF WAR calling FacesContext.getCurrentInstance() at startup to access resources from another deployed WAR. This is a loca...