CVE-2007-3101

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 44%

from disclosure to weapon0 days

Published on NVDJun 18

1st PoCJun 14

exploitation probability

44%top 1% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30191

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=544 http://osvdb.org/36377 http://secunia.com/advisories/25618 https://exchange.xforce.ibmcloud.com/vulnerabilities/34872 http://www.securityfocus.com/bid/24480 http://www.vupen.com/english/advisories/2007/2212