CVSS: 5.8EPSS: 1%CPEs: 6EXPL: 0CVE-2013-4390 – Apache Sling 1.1.2 Open Redirect
https://notcve.org/view.php?id=CVE-2013-4390
21 Oct 2013 — Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS." Vulnerabilidad en el AbstractAuthenticationFormServlet en bloque Auth (org.apache.sling.auth.core) antes de 1.1.4 de Apache Sling permite a atacantes remotos redirigir a los usuarios a sit... • http://mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4qdFxEW9NXBJoMsrBama8LFNyir%2B61A0Vfzp4njEpeU%3Dw%40mail.gmail.com%3E • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 2%CPEs: 3EXPL: 1CVE-2013-2254 – Apache Sling 2.2.0 / 2.3.0 Denial of Service
https://notcve.org/view.php?id=CVE-2013-2254
09 Oct 2013 — The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors. La función deepGetOrCreateNode en impl/operations/AbstractCreateOperation.java en org.apache.sling.servlets.post.bundle 2.2.0 y 2.3.0 de Apache S... • http://mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4pue6PnESsP1KTdEDJm1gpkANFaK%2BvUd9mzEVT7tXL%2B3A%40mail.gmail.com%3E • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 25%CPEs: 2EXPL: 1CVE-2012-2138 – Apache Sling - Denial of Service
https://notcve.org/view.php?id=CVE-2012-2138
09 Jul 2012 — The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request. La operación @CopyFrom en el servlet POST en el conjunto org.apache.sling.servlets.post anteriores a v2.1.2 en Apache Sling no previene intentos de copia sobre un nodo de nivel superior sobre uno de nivel inferior, lo ... • https://www.exploit-db.com/exploits/37487 • CWE-264: Permissions, Privileges, and Access Controls •