Apache : Security Vulnerabilities, CVEs, Published In April 2016 (XSS)
Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.
Max CVSS
6.1
EPSS Score
1.91%
Published
2016-04-12
Updated
2018-11-23
Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating an event.
Max CVSS
6.1
EPSS Score
14.60%
Published
2016-04-11
Updated
2018-10-09
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.
Max CVSS
6.1
EPSS Score
18.21%
Published
2016-04-12
Updated
2016-11-28
Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.
Max CVSS
6.1
EPSS Score
9.53%
Published
2016-04-11
Updated
2016-04-20
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource.
Max CVSS
6.1
EPSS Score
9.53%
Published
2016-04-11
Updated
2016-04-20
Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a <input> element.
Max CVSS
6.1
EPSS Score
0.66%
Published
2016-04-12
Updated
2019-02-13
Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 might allow remote attackers to inject arbitrary web script or HTML via a ModalWindow title.
Max CVSS
6.1
EPSS Score
1.91%
Published
2016-04-12
Updated
2019-02-12
Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.
Max CVSS
6.1
EPSS Score
0.25%
Published
2016-04-12
Updated
2018-10-09
Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header.
Max CVSS
6.1
EPSS Score
9.57%
Published
2016-04-11
Updated
2016-04-12
9 vulnerabilities found