Search for packages
| purl | pkg:maven/org.apache.myfaces.core/myfaces-impl@2.0.0-beta-2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-aj1q-r1y1-bkbh
Aliases: CVE-2011-4367 GHSA-gjfx-9wx3-j6r7 |
Directory traversal This package allow remote attackers to read arbitrary files via a `..` in the `ln` parameter to `faces/javax.faces.resource/web.xml` or the `PATH_INFO` to `faces/javax.faces.resource/`. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-dgtk-ndck-t7d9
Aliases: CVE-2010-2057 GHSA-4fv4-cq5v-x45m |
Encrypted view state does not include MAC `shared/util/StateUtils.java` in this package uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||