apache roller vulnerabilities and exploits

(subscribe to this query)

Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller prior to 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.

Apache Roller Apache Roller 0.9.5 Apache Roller 0.9.6 Apache Roller 0.9.6.3 Apache Roller 0.9.6.4 Apache Roller 0.9.7 Apache Roller 0.9.7.1 Apache Roller 0.9.7.2 Apache Roller 0.9.8 Apache Roller 0.9.8.1 Apache Roller 0.9.8.2 Apache Roller 0.9.9

Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller prior to 5.0.1 allow remote malicious users to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.

Apache Roller Apache Roller 0.9.5 Apache Roller 0.9.6 Apache Roller 0.9.6.3 Apache Roller 0.9.6.4 Apache Roller 0.9.7 Apache Roller 0.9.7.1 Apache Roller 0.9.7.2 Apache Roller 0.9.8 Apache Roller 0.9.8.1 Apache Roller 0.9.8.2 Apache Roller 0.9.9

The XML-RPC protocol support in Apache Roller prior to 5.0.3 allows malicious users to conduct XML External Entity (XXE) attacks via unspecified vectors.

Apache Roller 3.1 Apache Roller 4.0 Apache Roller 4.0.1 Apache Roller 5.0 Apache Roller 5.0.1 Apache Roller 5.0.2

1 EDB exploit

Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller prior to 5.0.2 allow remote malicious users to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed templates.

Apache Roller Apache Roller 4.0 Apache Roller 4.0.1 Apache Roller 5.0

Certain getText methods in the ActionSupport controller in Apache Roller prior to 5.0.2 allow remote malicious users to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login...

Apache Roller Apache Roller 4.0 Apache Roller 4.0.1 Apache Roller 5.0

1 EDB exploit

Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote malicious users to inject arbitrary web script or HTML via the q parameter in a search action.

Apache Roller 2.3 Apache Roller 3.0 Apache Roller 3.1 Apache Roller 4.0

Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and previous versions unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which ...

Apache Roller Apache Roller 5.2.0 Apache Roller 5.2.1

A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade ...

Apache Roller 5.2.0 Apache Roller 5.2.1 Apache Roller 5.2.2

The weblog page template in Apache Roller 5.1 up to and including 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).

Apache Roller 5.1.0 Apache Roller 5.1.1

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller...

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook