Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2565▼ 302 respecto a la semana anterior

Críticas / altas1351▲ 99 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior

Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2017-9802	Modificada	Media (6.1)	3.7%	—	Apache Sling Servlets Post	14/8/2017	17/6/2026	The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
CVE-2015-2944	Modificada	Media (4.3)	6.3%	—	Apache Sling API Apache Sling Servlets Post	2/6/2015	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
CVE-2013-2254	Modificada	Media (5)	4.1%	—	Org.apache.sling.servlets.post	17/10/2013	16/6/2026	The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of…
CVE-2012-2138	Modificada	Media (5)	14%	—	Org.apache.sling.servlets.post	9/7/2012	16/6/2026	The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.