Org.apache.sling:org.apache.sling.xss
This hub aggregates every CVE we track for Org.apache.sling:org.apache.sling.xss, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
3
CVEs tracked
1
Critical
0
High
0
In CISA KEV
Severity distribution
MEDIUM2CRITICAL1
Monthly trend
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2024-102026-09
Latest CVEs
The 3 most recently published vulnerabilities affecting Org.apache.sling:org.apache.sling.xss.
- CVE-2017-15717A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass a...6.1
- CVE-2016-6798In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts wh...9.8
- CVE-2016-5394In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags t...6.1
Product normalization is registry-driven with AI assist and human review. How it works