Oracle Mojarra JavaServer(TM) Faces 1.2_14

CPE Details

Oracle Mojarra JavaServer(TM) Faces 1.2_14
oracle
mojarra
1.2_14
2010-05-28
11h29 +00:00
2010-10-21
19h06 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:oracle:mojarra:1.2_14:*:*:*:*:*:*:*

Informations

Vendor

oracle

Product

mojarra

Version

1.2_14

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2010-4007 2010-10-20 17h00 +00:00 Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.
5
CVE-2010-2087 2010-05-27 18h32 +00:00 Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
4.3