Apache

Archiva

20 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8

CVE-2017-5657

  • EPSS 0.12%
  • Published 22.05.2017 18:29:00
  • Last modified 20.04.2025 01:37:25

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiv...

4.8

CVE-2016-5005

Exploit
  • EPSS 0.15%
  • Published 28.07.2016 16:59:01
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action.

8.8

CVE-2016-4469

Exploit
  • EPSS 0.8%
  • Published 28.07.2016 16:59:00
  • Last modified 12.04.2025 10:46:40

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to ...

4.3

CVE-2013-2187

  • EPSS 1.14%
  • Published 22.04.2014 14:23:34
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

9.8

CVE-2013-2251

Warning Exploit
  • EPSS 94.23%
  • Published 20.07.2013 03:37:30
  • Last modified 11.04.2025 00:51:21

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

4.3

CVE-2011-1077

Exploit
  • EPSS 2.39%
  • Published 02.06.2011 20:55:02
  • Last modified 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

6.8

CVE-2011-1026

Exploit
  • EPSS 0.71%
  • Published 02.06.2011 20:55:02
  • Last modified 11.04.2025 00:51:21

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.

4.3

CVE-2011-0533

  • EPSS 12.76%
  • Published 17.02.2011 18:00:03
  • Last modified 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, rela...

6.8

CVE-2010-3449

  • EPSS 2.24%
  • Published 06.12.2010 20:13:00
  • Last modified 11.04.2025 00:51:21

Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remo...

6.8

CVE-2010-4408

  • EPSS 1.39%
  • Published 06.12.2010 20:13:00
  • Last modified 11.04.2025 00:51:21

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gai...