Sling vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

SL

Product

Sling

by Apache · last CVE Jul 19, 2017

4

CVEs

0

On KEV

9.8

Max CVSS

0

New 30D

Vulnerabilities4 In the news0 Timeline

Severity mix

Critical 1High 1Medium 1Low 0

Severity

All severities4 Critical1 High1 Medium1 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Sling to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-6798	9.8	4%	Jul 19	In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks… Affected: through 1.0.10
CVE-2016-0956	7.5	51%	Feb 10	The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via… Affected: All versions, or not specified
CVE-2016-5394	6.1	3%	Jul 19	In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns… Affected: before 1.0.12
CVE-2013-4390	–	3%	Oct 24	Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to… Affected: All versions, or not specified