Apache Sling

4 results · Clear filters · Feed

• Medium 6.5
  CVE-2023-25621

  Apache Sling does not allow to handle i18n content in a secure way

  Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it a…

  Apache Software Foundation Apache Sling org.apache.sling:org.apache.sling.i18n Maven
  Feb 23, 2023
• Medium 5.3
  CVE-2022-32549

  log injection in Sling logging

  Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.

  Apache Software Foundation Apache Sling org.apache.sling:org.apache.sling.api org.apache.sling:org.apache.sling.commons.log Maven
  Jun 22, 2022
• Medium 6.1
  CVE-2017-15717

  Cross-site Scripting in Apache Sling XSS Protection API

  A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versio…

  Apache Software Foundation Apache Sling org.apache.sling:org.apache.sling.xss.compat org.apache.sling:org.apache.sling.xss Maven
  Jan 10, 2018
• Medium 6.1
  CVE-2016-5394 Public exploit

  Cross site scripting in Apache Sling

  In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabili…

  Apache Software Foundation Apache Sling org.apache.sling:org.apache.sling.xss.compat org.apache.sling:org.apache.sling.xss Maven
  Jul 19, 2017