DeutschShown in its original language — a full translation is planned for a future version.
Apache Sling: Mehrere Schwachstellen
view advisory published 2026-09-22
Ein Angreifer kann mehrere Schwachstellen in Apache Sling ausnutzen, um einen Denial of Service Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-94251US | — | — | ||
A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource
This issue affects Apache Sling Security Bundle: befo… | ||||
| CVE-2026-94243US | — | — | ||
A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.
This issue affects Apache Sling Security Bundle: before 1.3.2.
Users a… | ||||
| CVE-2026-92001US | — | — | ||
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Us… | ||||
| CVE-2026-91999US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Us… | ||||
| CVE-2026-91928US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Us… | ||||
| CVE-2026-91852US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Us… | ||||
| CVE-2026-73192US | — | — | ||
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.… | ||||
02
references
External citations — patches, advisories, analysis.
- Apache Mailing List vom 2026-09-22external
- Apache Mailing List vom 2026-09-22external
- Apache Mailing List vom 2026-09-22external
- Apache Mailing List vom 2026-09-22external
- Apache Mailing List vom 2026-09-22external
- Apache Mailing List vom 2026-09-22external
- WID-SEC-W-2026-3526 - CSAF Versionself
- WID-SEC-2026-3526 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan