Vulnerabilities > Apache > Myfaces > 1.1.7
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2010-10-20 | CVE-2010-2057 | Cryptographic Issues vulnerability in Apache Myfaces shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack. | 5.0 |
2010-05-27 | CVE-2010-2086 | Cross-Site Scripting vulnerability in Apache Myfaces 1.1.7/1.2.8 Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object. | 4.0 |