Skip to content
OpenAdvisories

Package · Debian

tiles

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2023-49735

    Apache Tiles: Unvalidated input may lead to path traversal and XXE

    ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data…

    Apache Software Foundation Apache Tiles struts:struts org.apache.tiles:tiles-core Debian Ubuntu Maven
  • Medium —
    CVE-2009-1275

    Apache Tiles Vulnerable to XSS via EL Expression Injection

    Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive informat…

    org.apache.tiles:tiles-core tiles Debian Maven