1.2.8

DATE	CVE	VULNERABILITY TITLE	RISK
2010-10-20	CVE-2010-2057	Cryptographic Issues vulnerability in Apache Myfaces shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack. network low complexity apache CWE-310	5.0
2010-05-27	CVE-2010-2086	Cross-Site Scripting vulnerability in Apache Myfaces 1.1.7/1.2.8 Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object. network high complexity apache CWE-79	4.0