Apache Software Foundation Sling 1.1.6

CPE Details

Apache Software Foundation Sling 1.1.6
apache
sling
1.1.6
2023-02-10
18h13 +00:00
2023-03-03
12h45 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:apache:sling:1.1.6:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

sling

Version

1.1.6

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2022-45064 2023-04-13 10h01 +00:00 The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power. Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.
9
Critique
CVE-2016-0956 2016-02-10 19h00 +00:00 The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
7.5
Haute
CVE-2013-4390 2013-10-24 01h00 +00:00 Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
5.8
CVE-2013-2254 2013-10-17 21h00 +00:00 The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
5
CVE-2012-2138 2012-07-09 22h00 +00:00 The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
5