org.apache.sling:org.apache.sling.api

3 results · Feed

• Medium 5.3
  CVE-2022-32549

  log injection in Sling logging

  Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.

  Apache Software Foundation Apache Sling org.apache.sling:org.apache.sling.api org.apache.sling:org.apache.sling.commons.log Maven
  Jun 22, 2022
• Medium —
  CVE-2015-2944

  Improper Neutralization of Input During Web Page Generation in Apache Sling

  Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlRespon…

  org.apache.sling:org.apache.sling.servlets.post org.apache.sling:org.apache.sling.api Maven
  Jun 2, 2015
• Medium —
  CVE-2013-2254

  Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling

  The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the roo…

  org.apache.sling:org.apache.sling.api Maven
  Oct 17, 2013