Sling

sling

Vendor: Apache • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-6798 1Apache 1Sling May 13, 2026 Jul 19, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to...Show more In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.Show less
CVE-2016-5394 1Apache 1Sling May 13, 2026 Jul 19, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencode...Show more In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.Show less
CVE-2016-0956 2Adobe Apache 2Experience Manager Sling May 6, 2026 Feb 10, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2013-4390 1Apache 2Sling Sling Auth Core Component Apr 29, 2026 Oct 24, 2013 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and...Show more Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."Show less