Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.sling:org.apache.sling.xss

3 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3
Registry
Maven Central

Advisories 3

  • A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and…

    Affected: from 1.0.4, fixed in 2.0.4.

  • In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the…

    Affected: fixed in 1.0.12.

  • In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not…

    Affected: fixed in 1.0.12.