Oracle Mojarra vulnerabilities

4 CVEs affecting Oracle Mojarra, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-5855, published 2014-07-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-5855, published 2014-07-17. Medium severity, CVSS 4.3. EPSS: 4.7% chance of exploitation in the next 30 days. Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows…
CVE-2010-2087, published 2010-05-27. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers…
CVE-2010-4007, published 2010-10-20. Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days. Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding…
CVE-2012-2672, published 2012-06-17. Low severity, CVSS 2.1. EPSS: 0.5% chance of exploitation in the next 30 days. Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by…