Jon Passki

Name of the Vulnerable Software and Affected Versions: Spring Framework versions prior to 3.2.2 Description: The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via specific Unicode characters, including line separator, paragraph separator, left angle bracket, or right angle bracket, due to improper escaping by the `javascriptEscape` method in `JavaScriptUtils.java`. Recommendations: For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue.

The issue concerns Multiple XML External Entity (XXE) vulnerabilities in certain classes of JBoss Seam Remoting. These vulnerabilities allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file. The affected classes include ExecutionHandler, PollHandler, and SubscriptionHandler.

The issue is related to the implementation of the OGNL (Object-Graph Navigation Language) expression language class in the Apache Struts platform, which is associated with incorrect code generation management. This allows a remote attacker to execute arbitrary code by sending a specially crafted request that contains both "${}" and "%{}" sequences, causing the OGNL code to be evaluated twice.

The issue is related to the implementation of the OGNL (Object-Graph Navigation Language) expression language class in the Apache Struts platform, which is associated with incorrect code generation management. Exploitation of this issue may allow a remote attacker to execute arbitrary code by sending a specially crafted request.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `postpreservationdata` parameter in the login.fcc component. This could potentially lead to unauthorized actions on behalf of the user.

The issue allows local users to gain console privileges through vectors related to log files, "insecure file operation," and syncing an iPhone, iPad, or iPod touch.