Threats tagged 'ghsa-4hw7-pfg5-v529'

Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11 have a reflected cross-site scripting (XSS) vulnerability when URL client window mode is enabled. The client window id parameter is appended to URLs without URL-encoding, and the h:button component renders these URLs into JavaScript string literals. This allows an attacker to inject scripts that run on page load, bypassing Content Security Policy when nonce support is enabled.