Apache Software Foundation Sling 1.1.6

CPE Details

Apache Software Foundation Sling 1.1.6
apache
sling
1.1.6
2023-02-10
18h13 +00:00
2023-03-03
12h45 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:apache:sling:1.1.6:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

sling

Version

1.1.6

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-45064 2023-04-13 10h01 +00:00 The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power. Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.
9
Critical
CVE-2016-0956 2016-02-10 19h00 +00:00 The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
7.5
High
CVE-2013-4390 2013-10-24 01h00 +00:00 Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
5.8
CVE-2013-2254 2013-10-17 21h00 +00:00 The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
5
CVE-2012-2138 2012-07-09 22h00 +00:00 The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
5