CVE-2013-5855
Published Jul 17, 2014Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style b…
Vendor/product archive
oracle / mojarra CVEs
Beta · best-effort4 CVEs tagged to oracle / mojarra — 0 Critical, 0 High, 3 Medium, 1 Low, 0 Unrated.
CVE-2012-2672
Published Jun 17, 2012Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from anothe…
CVE-2010-4007
Published Oct 20, 2010Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View…
CVE-2010-2087
Published May 27, 2010Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allow…
Showing 1-4 of 4 CVEsPage 1 of 1