← Back

Mojarra

mojarra

Vendor: Eclipse • 4 CVEs

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-46581
1Eclipse
1Mojarra
Aug 10, 2026
Aug 5, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included...Show more
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.Show less
CVE-2020-6950
2Eclipse
Oracle
9Banking Enterprise Default Management
Banking PlatformCommunications Network Integrity+6 more
Jun 17, 2026
Jun 2, 2021
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2019-17091
2Eclipse
Oracle
23Application Testing Suite
Banking Enterprise Product ManufacturingCommunications Diameter Signaling Router+20 more
Jun 17, 2026
Oct 2, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled...Show more
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.Show less
CVE-2018-14371
1Eclipse
1Mojarra
Nov 21, 2024
Jul 18, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from app...Show more
The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.Show less