Claude Code

**Name of the Vulnerable Software and Affected Versions** Apache Sling XSS versions prior to 2.4.12 **Description** Improper neutralization of input during web page generation leads to a cross-site scripting (XSS) issue. Cross-site scripting is a flaw where an application includes untrusted data in a web page without proper validation or encoding, allowing an attacker to execute malicious scripts in the victim's browser. **Recommendations** Upgrade to version 2.4.12.

**Name of the Vulnerable Software and Affected Versions** Apache Sling XSS versions prior to 2.4.12 **Description** Improper neutralization of input during web page generation leads to a cross-site scripting (XSS) issue. Cross-site scripting is a flaw where an application includes untrusted data in a web page without proper validation or encoding, allowing an attacker to execute malicious scripts in the victim's browser. **Recommendations** Upgrade to version 2.4.12.

**Name of the Vulnerable Software and Affected Versions** Apache Sling XSS versions prior to 2.4.12 **Description** Improper restriction of recursive entity references in Document Type Definitions (DTDs), known as XML entity expansion, allows for potential resource exhaustion or denial of service. **Recommendations** Upgrade to version 2.4.12.

**Name of the Vulnerable Software and Affected Versions** Apache Sling Security Bundle versions prior to 1.3.2 **Description** The `ReferrerFilter` accepts evidence that is weaker than the origin, which may allow for security bypasses. **Recommendations** Upgrade to version 1.3.2.

**Name of the Vulnerable Software and Affected Versions** Apache Sling Security Bundle versions prior to 1.3.12 **Description** The `ContentDispositionFilter` in the Apache Sling Security Bundle mediates only one address or API shape of a resource, which may lead to security bypasses. **Recommendations** Upgrade to version 1.3.12.