Search for packages
| purl | pkg:deb/debian/mojarra@0?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-132f-p6xh-4ydm | Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057. |
CVE-2010-4007
|
| VCID-5sf4-cx8k-guae | Cross-site Scripting in Eclipse Mojarra faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled. |
CVE-2019-17091
GHSA-rjhx-c9qh-qh8f |
| VCID-aj1q-r1y1-bkbh | Directory traversal This package allow remote attackers to read arbitrary files via a `..` in the `ln` parameter to `faces/javax.faces.resource/web.xml` or the `PATH_INFO` to `faces/javax.faces.resource/`. |
CVE-2011-4367
GHSA-gjfx-9wx3-j6r7 |
| VCID-tbhh-2tte-kkdk | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. |
CVE-2020-6950
GHSA-rpq8-mmwh-q9hm |
| VCID-ud7m-cc54-3qbv | The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications. |
CVE-2018-14371
GHSA-43q7-q5vp-3g68 |