Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

GHSA-xwf4-88xr-hx2j

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-xwf4-88xr-hx2j

Cross site scripting in Apache Sling In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

gitlab/maven/org.apache.sling/org.apache.sling.xss.compat/CVE-2016-5394

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.