CVE-2017-1000486

CVE-2017-1000486 affects Primetek Primefaces 5.x, with a weak encryption flaw enabling remote code execution. Public details describe a padding oracle issue exploited by attackers; Primefaces versions prior to 5.2.21, 5.3.8, or 6.0 are noted as vulnerable, with patches implied for those lines. Pu...

CVE-2020-10544

PrimeFaces 7.0.11 (PrimeTek) has an XSS vulnerability in tooltip.js where user-supplied data used as a tooltip title can inject JavaScript due to lack of input validation. Affected component: tooltip functionality in PrimeFaces web applications. Root cause: input data used for tooltip titles is n...