Jon Passki

**Nome do software vulnerável e versões afetadas: Versões do Spring Framework anteriores à 3.2.2 Descrição: A vulnerabilidade permite que invasores remotos realizem ataques de script entre sites (XSS) por meio de caracteres Unicode específicos, incluindo separador de linha, separador de parágrafo, colchete esquerdo ou colchete direito, devido a uma escapagem inadequada pelo método `javascriptEscape` em `JavaScriptUtils.java`. Recomendações: Para versões anteriores à 3.2.2, atualize para a versão 3.2.2 ou posterior para resolver o problema.

The issue concerns Multiple XML External Entity (XXE) vulnerabilities in certain classes of JBoss Seam Remoting. These vulnerabilities allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file. The affected classes include ExecutionHandler, PollHandler, and SubscriptionHandler.

The issue is related to the implementation of the OGNL (Object-Graph Navigation Language) expression language class in the Apache Struts platform, which is associated with incorrect code generation management. This allows a remote attacker to execute arbitrary code by sending a specially crafted request that contains both "${}" and "%{}" sequences, causing the OGNL code to be evaluated twice.

The issue is related to the implementation of the OGNL (Object-Graph Navigation Language) expression language class in the Apache Struts platform, which is associated with incorrect code generation management. Exploitation of this issue may allow a remote attacker to execute arbitrary code by sending a specially crafted request.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `postpreservationdata` parameter in the login.fcc component. This could potentially lead to unauthorized actions on behalf of the user.

The issue allows local users to gain console privileges through vectors related to log files, "insecure file operation," and syncing an iPhone, iPad, or iPod touch.