Apache Archiva vulnerable to Cross-site Scripting

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-5005 · ADVISORY
• apache/archiva · PACKAGE
• lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E · WEB
• web.archive.org/web/20211208111430/https://securitytracker.com/id/1036475 · WEB
• packetstormsecurity.com/files/137870/Apache-Archiva-1.3.9-Cross-Site-Scripting.html · WEB
• seclists.org/fulldisclosure/2016/Jul/38 · WEB
• securityfocus.com/archive/1/538878/100/0/threaded · WEB
• securityfocus.com/bid/91707 · WEB
• securitytracker.com/id/1036475
• lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

More vulnerabilities in org.apache.archiva:archiva

• CVE-2024-27139HIGH 7.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauth…
• CVE-2024-27138HIGH 7.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user regis…
• CVE-2023-28158MEDIUM 5.4Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authentica…
• CVE-2022-29405MEDIUM 6.5In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
• CVE-2020-9495MEDIUM 5.3Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the conne…