WaratekVRT Sign in

Oracle Mojarra CVEs

5 CVEs, 2 protected by Waratek

Reset
More filters (2)
Columns
Vendor oracle✕Product mojarra✕
Overview 5 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
5matches 2protected40.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 60.0%
Critical 0 0.0% High 0 0.0% Medium 4 80.0% Low 1 20.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 40.0% partly blocked 0 0.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 100.0%
split by peak 2 / year
No exploit published: 3Protected by Waratek: 2 Low: 1Medium: 4 not blocked: 3blocked by ARMR today: 2 No public exploit: 5
20102 No exploit published2 Medium2 not blocked2 No public exploit2 20110 20121 No exploit published1 Low1 not blocked1 No public exploit1 20130 20141 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20150 20160 20170 20180 20191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
2010201120122013201420152016201720182019
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-17091 Medium 2019-10-02 Protected by Waratek No public exploit faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
CVE-2013-5855 Medium 2014-07-17 Protected by Waratek No public exploit Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
CVE-2012-2672 Low 2012-06-17 No exploit published No public exploit Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.
CVE-2010-4007 Medium 2010-10-20 No exploit published No public exploit Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.
CVE-2010-2087 Medium 2010-05-27 No exploit published No public exploit Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.