Sling (Apache) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 9 known versions, newest CVE from 2023-04-13. Vendor: Apache.

CVEs of Sling

• CVE-2022-45064 - CVSS 9 (critical), 2023-04-13: The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on…
• CVE-2016-5394 - CVSS 6.1 (medium), 2017-07-19: In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for…
• CVE-2016-6798 - CVSS 9.8 (critical), 2017-07-19: In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which…
• CVE-2016-0956 - CVSS 7.5 (high), 2016-02-10: The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive…
• CVE-2013-4390 - CVSS 5.8 (medium), 2013-10-24: Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows…