Jetspeed (Apache) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2022-07-06. Vendor: Apache.

CVEs of Jetspeed

• CVE-2022-32533 - CVSS 9.8 (critical), 2022-07-06: Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the…
• CVE-2016-2171 - CVSS 7.5 (high), 2016-04-11: The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add,…
• CVE-2016-0712 - CVSS 6.1 (medium), 2016-04-11: Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to…
• CVE-2016-0711 - CVSS 6.1 (medium), 2016-04-11: Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the…
• CVE-2016-0710 - CVSS 8.8 (high), 2016-04-11: Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands…
• CVE-2016-0709 - CVSS 7.2 (high), 2016-04-11: Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated…