Threats Tagged 'ghsa-fp43-vj7g-pg92'

Multiple vulnerabilities exist in OmniFaces related to forged combined-resource IDs, unbounded caches, cross-site scripting via hashParam, session push-channel replay, and push idle-connection handling. Forged combined-resource IDs allow attackers to inflate resource usage and bypass resource boundaries. The source-map cache can grow unboundedly. The hashParam component can lead to JavaScript injection in Ajax callbacks. Session push channels are not properly bound to HTTP sessions, enabling replay of push messages. Push channel idle timeouts and client fanout lack proper limits. These issues affect multiple OmniFaces versions prior to fixed releases.