Apache Tapestry (Apache) - vulnerabilities (CVEs)

2 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2019-09-16. Vendor: Apache.

CVEs of Apache Tapestry

• CVE-2019-10071 - CVSS 9.8 (critical), 2019-09-16: The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC…
• CVE-2019-0207 - CVSS 7.5 (high), 2019-09-16: Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`,…