CVSS: 5.0EPSS: 0%CPEs: 22EXPL: 0CVE-2010-4007
https://notcve.org/view.php?id=CVE-2010-4007
Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057. Oracle Mojarra usa un View State cifrado sin un Código de Autenticación de Mnesaje (MAC), lo que hace más sencillo para atacantes realizar modificaciones exitosas del View State a través de un ataque de relleno. Un problema relacionado con CVE-2010-2057. • https://bugzilla.redhat.com/show_bug.cgi?id=623799 https://issues.apache.org/jira/browse/MYFACES-2749 • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 2CVE-2010-2087
https://notcve.org/view.php?id=CVE-2010-2087
Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object. Oracle Mojarra v1.2_14 y v2.0.2, utilizado en IBM WebSphere Application Server, Caucho Resin, y otras aplicaciones, no maneja adecuadamente un estado de vista sin cifrar, lo que permite a atacantes remotos dirigir ataques de secuencias de comandos en sitios cruzados (XSS) o ejecutar sentencias del lenguaje de expresión (EL) a través de vectores que pretenden modificar las vistas de objetos serializados. • http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •