Skip to content
OpenAdvisories

Package · Maven

org.apache.myfaces.core:myfaces-core-module

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High —
    CVE-2021-26296

    Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

    In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is poss…

    Apache Software Foundation Apache MyFaces Core org.apache.myfaces.core:myfaces-core-module Maven
  • High 7.5
    CVE-2011-4343

    Apache MyFaces Vulnerable to EL Injection

    Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

    org.apache.myfaces.core:myfaces-core-module Maven
  • Medium —
    CVE-2010-2086

    Apache MyFaces Cross-site Scripting vulnerability

    Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression…

    org.apache.myfaces.core:myfaces-core-module Maven