Apache Software Foundation MyFaces 1.1.7
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:myfaces:1.1.7:*:*:*:*:*:*:*
part: a version: 1.1.7 update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Myfaces (1bbda4ad-3e51-56c6-a46b-9825905d9c60) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/myfaces |
purl2cpe | 2026-06-01 10:14:25.070663 |
pkg:github/apache/myfaces |
purl2cpe | 2026-06-01 10:14:25.070664 |
pkg:maven/org.apache.myfaces/myfaces |
purl2cpe | 2026-06-01 10:14:25.070665 |
pkg:rpm/opensuse/myfaces |
purl2cpe | 2026-06-01 10:14:25.070667 |
pkg:sourceforge/myfaces |
purl2cpe | 2026-06-01 10:14:25.070668 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2010-2086 |
vulnerable | 2026-06-08 04:54:11.621315 |
Details available
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Published: 2010-05-27T18:32:00.000Z
Updated: 2024-09-17T02:36:44.662Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-2057 |
vulnerable | 2026-06-08 04:54:11.406629 |
Details available
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
Published: 2010-10-20T17:00:00.000Z
Updated: 2024-08-07T02:17:14.378Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.