CVSS: 5.3EPSS: 0%CPEs: 16EXPL: 0CVE-2010-2057
https://notcve.org/view.php?id=CVE-2010-2057
20 Oct 2010 — shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack. shared/util/StateUtils.java en Apache MyFaces v1.1.x anterior a v1.1.8, v1.2.x anterior a v1.2.9, y v2.0.x anterior a v2.0.1 utiliza un cifrado View State sin un Codigo de Autenticación de Mensaje (MAC),... • http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801 • CWE-310: Cryptographic Issues •
CVSS: 5.8EPSS: 1%CPEs: 2EXPL: 0CVE-2010-2086 – MyFaces: XSS via state view
https://notcve.org/view.php?id=CVE-2010-2086
27 May 2010 — Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object. Apache MyFaces v1.1.7 y v1.2.8, como el usado en IBM WebSphere Application Server y otras aplicaciones, no maneja de forma adecuada el estado de vista no cifrada lo... • http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •