Apache Apache Sling
7 CVEs affecting Apache Apache Sling. Latest disclosed: 2023-02-23. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6798 | Critical | 9.8 | 2017-07-19 | In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which al… |
CVE-2017-15700 | High | 8.8 | 2017-12-18 | A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling log… |
CVE-2012-3353 | High | 7.5 | 2018-01-09 | The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repos… |
CVE-2023-25621 | Medium | 6.5 | 2023-02-23 | Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a lo… |
CVE-2017-15717 | Medium | 6.1 | 2018-01-10 | A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref… |
CVE-2016-5394 | Medium | 6.1 | 2017-07-19 | In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for so… |
CVE-2022-32549 | Medium | 5.3 | 2022-06-22 | Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover trac… |