2 results · Clear filters · Feed
-
Medium 4.7
Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitt…
-
Medium 5.9
Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issu…