GHSA-qpr7-5m63-hq2c

Improper Neutralization of Input During Web Page Generation in JAMon

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-6235

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.jamonapi:jamon	< 2.80	2.80

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listenertype or (2) currentlistener parameter to mondetail.jsp or ArraySQL parameter to (3) mondetail.jsp, (4) jamonadmin.jsp, (5) sql.jsp, or (6) exceptions.jsp.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-6235 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90699 web
http://osvdb.org/102570 web
http://osvdb.org/102571 web
http://osvdb.org/102572 web
http://osvdb.org/102573 web
http://packetstormsecurity.com/files/124933 web
http://seclists.org/fulldisclosure/2014/Jan/164 web
http://www.securityfocus.com/archive/1/530877/100/0/threaded web