Apache Sling (Apache Software Foundation) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2023-02-23. Vendor: Apache Software Foundation.

CVEs of Apache Sling

• CVE-2023-25621 - CVSS 6.5 (medium), 2023-02-23: Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a…
• CVE-2022-32549 - CVSS 5.3 (medium), 2022-06-22: Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover…
• CVE-2017-15717 - CVSS 6.1 (medium), 2018-01-10: A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and…
• CVE-2012-3353 - CVSS 7.5 (high), 2018-01-09: The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content…
• CVE-2017-15700 - CVSS 8.8 (high), 2017-12-18: A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling…
• CVE-2016-5394 - CVSS 6.1 (medium), 2017-07-19: In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for…
• CVE-2016-6798 - CVSS 9.8 (critical), 2017-07-19: In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which…