Skip to content
OpenAdvisories

Package · Debian

mojarra

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 6.1
    CVE-2026-120421

    Reflected XSS via client window id in URL client window mode

    In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` requ…

    Eclipse Foundation Eclipse Mojarra mojarra mojarra Debian Ubuntu
  • Medium —
    CVE-2013-5855

    Improper Neutralization of Input During Web Page Generation in Mojarra

    Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attack…

    mojarra org.glassfish:javax.faces Debian Maven
  • Unscored —
    CVE-2011-4358

    Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.0.1 and 3.1.1 allows remote attackers to affect confi…

    mojarra Debian
  • Unscored —
    CVE-2012-2672

    Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users t…

    mojarra Debian
  • Unscored —
    CVE-2010-2087

    Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, doe…

    mojarra Debian