Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities found for continuum by apache

FKIE_CVE-2016-15057

Vulnerability from fkie_nvd - Published: 2026-01-26 12:15 - Updated: 2026-01-27 20:29
Severity ?
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
security@apache.orghttps://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1Mailing List
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2026/01/26/1Mailing List, Third Party Advisory
Impacted products
Vendor Product Version
apache continuum *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:continuum:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "55131A7E-DBFB-4AA0-96EE-1176C1227A75",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "security@apache.org",
      "tags": [
        "unsupported-when-assigned"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."
    },
    {
      "lang": "es",
      "value": " NO COMPATIBLE CUANDO ASIGNADO  Neutralizaci\u00f3n Inadecuada de Elementos Especiales utilizados en un Comando (\u0027inyecci\u00f3n de comandos\u0027) vulnerabilidad en Apache Continuum.\n\nEste problema afecta a Apache Continuum: todas las versiones.\n\nAtacantes con acceso a la API REST de las instalaciones pueden usar esto para invocar comandos arbitrarios en el servidor.\n\nDado que este proyecto est\u00e1 retirado, no planeamos lanzar una versi\u00f3n que solucione este problema. Se recomienda a los usuarios que encuentren una alternativa o restrinjan el acceso a la instancia a usuarios de confianza.\n\nNOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles por el mantenedor."
    }
  ],
  "id": "CVE-2016-15057",
  "lastModified": "2026-01-27T20:29:50.263",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-26T12:15:46.353",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/01/26/1"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2011-0533

Vulnerability from fkie_nvd - Published: 2011-02-17 18:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
References
secalert@redhat.comhttp://continuum.apache.org/security.html
secalert@redhat.comhttp://jira.codehaus.org/browse/CONTINUUM-2604
secalert@redhat.comhttp://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E
secalert@redhat.comhttp://osvdb.org/70925
secalert@redhat.comhttp://seclists.org/fulldisclosure/2011/Feb/236Patch
secalert@redhat.comhttp://secunia.com/advisories/43261Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/43334Vendor Advisory
secalert@redhat.comhttp://securityreason.com/securityalert/8091
secalert@redhat.comhttp://securitytracker.com/id?1025065
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1066053Patch
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1066056Patch
secalert@redhat.comhttp://www.securityfocus.com/archive/1/516342/100/0/threaded
secalert@redhat.comhttp://www.securityfocus.com/archive/1/516474/100/0/threaded
secalert@redhat.comhttp://www.securityfocus.com/bid/46311
secalert@redhat.comhttp://www.vupen.com/english/advisories/2011/0373Vendor Advisory
secalert@redhat.comhttp://www.vupen.com/english/advisories/2011/0426Vendor Advisory
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/65343
secalert@redhat.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581
af854a3a-2127-422b-91ae-364da2661108http://continuum.apache.org/security.html
af854a3a-2127-422b-91ae-364da2661108http://jira.codehaus.org/browse/CONTINUUM-2604
af854a3a-2127-422b-91ae-364da2661108http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/70925
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2011/Feb/236Patch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43261Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43334Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8091
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1025065
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1066053Patch
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1066056Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/516342/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/516474/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/46311
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0373Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0426Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/65343
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581
Impacted products
Vendor Product Version
apache continuum 1.1
apache continuum 1.2
apache continuum 1.2.2
apache continuum 1.2.3
apache continuum 1.2.3.1
apache continuum 1.3.6
apache continuum 1.4.0
apache archiva 1.0
apache archiva 1.0.1
apache archiva 1.0.2
apache archiva 1.0.3
apache archiva 1.1
apache archiva 1.1.1
apache archiva 1.1.2
apache archiva 1.1.3
apache archiva 1.1.4
apache archiva 1.2
apache archiva 1.2.1
apache archiva 1.2.2
apache archiva 1.3
apache archiva 1.3.1
apache archiva 1.3.2
apache archiva 1.3.3
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "117CA011-B3D9-4A0B-B9D4-3CCADA18C880",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B9378F8-FEE0-4044-BFDD-609B9EF63FC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "29D35B80-7257-4F31-95CE-4A5D246BB949",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "93FC5BC1-4022-433C-80A8-369F9658BB76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0189E53C-113E-4A38-8CAC-C0D536797AF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BBBB14F-9048-4D92-B712-2DB48FB0F54B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.4.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "94C2C439-588B-457F-B66C-577FC5DBAB5E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFD6FB90-E505-48D6-B9D1-3E8DD3A47234",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "21DF9796-959A-4566-8AEF-16ABD8E36444",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "08C7B72C-957A-44FA-BABA-03A7E4CEF36A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CFEDC8F-0FE0-4E69-8F6F-BD49AB46D8CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FF7D312-B1C1-400B-AF0C-7375B1B3F0E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "31357E13-6571-4FE9-A5E0-2CACE0423C2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED2E53F7-845B-4077-9AC9-EAAE60ADC75A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF420D40-A4BE-4B74-9457-01E1FFF9D9A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1389E21-2451-45FF-97C3-87B58A496E64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC7E1832-3889-477D-9DA4-869B6867EBC3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F945FF3A-483C-4CD5-A413-0C354C15A99F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCCF9A1C-7091-4D72-8AFC-5373F45FF7D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D1D107D-C022-43B4-BA64-0D39F31EE226",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F26131F0-693E-4245-9DC1-645B0EACD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEC394AE-2522-476B-82A9-5F7410B55398",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C14AFD31-A944-4422-A142-AE95AD8E1424",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en Continuum versiones 1.1 hasta 1.2.3.1, versiones 1.3.6 y 1.4.0 Beta; y Archiva versiones 1.3.0 hasta 1.3.3 y versiones 1.0 hasta 1.22 de Apache, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio de un par\u00e1metro especialmente dise\u00f1ado, relacionado con la configuraci\u00f3n autoIncludeParameters para la tabla extremecomponents."
    }
  ],
  "id": "CVE-2011-0533",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-02-17T18:00:03.760",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://continuum.apache.org/security.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/70925"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43261"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43334"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securityreason.com/securityalert/8091"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securitytracker.com/id?1025065"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/46311"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0373"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0426"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://continuum.apache.org/security.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/70925"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43261"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43334"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8091"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1025065"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/46311"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0373"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0426"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2016-15057 (GCVE-0-2016-15057)

Vulnerability from cvelistv5 – Published: 2026-01-26 11:29 – Updated: 2026-01-26 18:06 Unsupported When Assigned
VLAI?
Title
Apache Continuum: Command injection leading to RCE
Summary
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Continuum Affected: 0 , < * (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.9,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2016-15057",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T14:48:37.640113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T14:49:40.287Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-26T18:06:06.158Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/26/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.continuum:continuum",
          "product": "Apache Continuum",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Continuum: all versions.\u003c/p\u003e\u003cp\u003eAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\u003c/p\u003e\u003cp\u003eAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\u003c/p\u003e\u003cp\u003eNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\u003c/p\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T11:29:03.524Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Continuum: Command injection leading to RCE",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2016-15057",
    "datePublished": "2026-01-26T11:29:03.524Z",
    "dateReserved": "2026-01-23T11:27:11.437Z",
    "dateUpdated": "2026-01-26T18:06:06.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2011-0533 (GCVE-0-2011-0533)

Vulnerability from cvelistv5 – Published: 2011-02-17 17:00 – Updated: 2024-08-06 21:58
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/70925 vdb-entryx_refsource_OSVDB
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.securityfocus.com/bid/46311 vdb-entryx_refsource_BID
http://secunia.com/advisories/43261 third-party-advisoryx_refsource_SECUNIA
http://jira.codehaus.org/browse/CONTINUUM-2604 x_refsource_CONFIRM
http://mail-archives.apache.org/mod_mbox/continuu… mailing-listx_refsource_MLIST
http://www.vupen.com/english/advisories/2011/0373 vdb-entryx_refsource_VUPEN
http://securitytracker.com/id?1025065 vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/516474/100… mailing-listx_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://securityreason.com/securityalert/8091 third-party-advisoryx_refsource_SREASON
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2011/0426 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/43334 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.securityfocus.com/archive/1/516342/100… mailing-listx_refsource_BUGTRAQ
http://continuum.apache.org/security.html x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2011/Feb/236 mailing-listx_refsource_FULLDISC
Date Public ?
2011-02-10 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:58:25.087Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "70925",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/70925"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
          },
          {
            "name": "46311",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/46311"
          },
          {
            "name": "43261",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43261"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
          },
          {
            "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
          },
          {
            "name": "ADV-2011-0373",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0373"
          },
          {
            "name": "1025065",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1025065"
          },
          {
            "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:12581",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
          },
          {
            "name": "8091",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8091"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
          },
          {
            "name": "ADV-2011-0426",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0426"
          },
          {
            "name": "43334",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43334"
          },
          {
            "name": "continuum-unspec-xss(65343)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
          },
          {
            "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://continuum.apache.org/security.html"
          },
          {
            "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-02-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "70925",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/70925"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
        },
        {
          "name": "46311",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/46311"
        },
        {
          "name": "43261",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43261"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
        },
        {
          "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
        },
        {
          "name": "ADV-2011-0373",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0373"
        },
        {
          "name": "1025065",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1025065"
        },
        {
          "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:12581",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
        },
        {
          "name": "8091",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8091"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
        },
        {
          "name": "ADV-2011-0426",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0426"
        },
        {
          "name": "43334",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43334"
        },
        {
          "name": "continuum-unspec-xss(65343)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
        },
        {
          "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://continuum.apache.org/security.html"
        },
        {
          "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-0533",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "70925",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/70925"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
            },
            {
              "name": "46311",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/46311"
            },
            {
              "name": "43261",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43261"
            },
            {
              "name": "http://jira.codehaus.org/browse/CONTINUUM-2604",
              "refsource": "CONFIRM",
              "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
            },
            {
              "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "MLIST",
              "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360@apache.org%3E"
            },
            {
              "name": "ADV-2011-0373",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0373"
            },
            {
              "name": "1025065",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1025065"
            },
            {
              "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:12581",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
            },
            {
              "name": "8091",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8091"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
            },
            {
              "name": "ADV-2011-0426",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0426"
            },
            {
              "name": "43334",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43334"
            },
            {
              "name": "continuum-unspec-xss(65343)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
            },
            {
              "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
            },
            {
              "name": "http://continuum.apache.org/security.html",
              "refsource": "CONFIRM",
              "url": "http://continuum.apache.org/security.html"
            },
            {
              "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-0533",
    "datePublished": "2011-02-17T17:00:00.000Z",
    "dateReserved": "2011-01-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T21:58:25.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-15057 (GCVE-0-2016-15057)

Vulnerability from nvd – Published: 2026-01-26 11:29 – Updated: 2026-01-26 18:06 Unsupported When Assigned
VLAI?
Title
Apache Continuum: Command injection leading to RCE
Summary
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Continuum Affected: 0 , < * (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.9,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2016-15057",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T14:48:37.640113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T14:49:40.287Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-26T18:06:06.158Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/26/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.continuum:continuum",
          "product": "Apache Continuum",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Continuum: all versions.\u003c/p\u003e\u003cp\u003eAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\u003c/p\u003e\u003cp\u003eAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\u003c/p\u003e\u003cp\u003eNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\u003c/p\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T11:29:03.524Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Continuum: Command injection leading to RCE",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2016-15057",
    "datePublished": "2026-01-26T11:29:03.524Z",
    "dateReserved": "2026-01-23T11:27:11.437Z",
    "dateUpdated": "2026-01-26T18:06:06.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2011-0533 (GCVE-0-2011-0533)

Vulnerability from nvd – Published: 2011-02-17 17:00 – Updated: 2024-08-06 21:58
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/70925 vdb-entryx_refsource_OSVDB
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.securityfocus.com/bid/46311 vdb-entryx_refsource_BID
http://secunia.com/advisories/43261 third-party-advisoryx_refsource_SECUNIA
http://jira.codehaus.org/browse/CONTINUUM-2604 x_refsource_CONFIRM
http://mail-archives.apache.org/mod_mbox/continuu… mailing-listx_refsource_MLIST
http://www.vupen.com/english/advisories/2011/0373 vdb-entryx_refsource_VUPEN
http://securitytracker.com/id?1025065 vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/516474/100… mailing-listx_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://securityreason.com/securityalert/8091 third-party-advisoryx_refsource_SREASON
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2011/0426 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/43334 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.securityfocus.com/archive/1/516342/100… mailing-listx_refsource_BUGTRAQ
http://continuum.apache.org/security.html x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2011/Feb/236 mailing-listx_refsource_FULLDISC
Date Public ?
2011-02-10 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:58:25.087Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "70925",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/70925"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
          },
          {
            "name": "46311",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/46311"
          },
          {
            "name": "43261",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43261"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
          },
          {
            "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
          },
          {
            "name": "ADV-2011-0373",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0373"
          },
          {
            "name": "1025065",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1025065"
          },
          {
            "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:12581",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
          },
          {
            "name": "8091",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8091"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
          },
          {
            "name": "ADV-2011-0426",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0426"
          },
          {
            "name": "43334",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43334"
          },
          {
            "name": "continuum-unspec-xss(65343)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
          },
          {
            "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://continuum.apache.org/security.html"
          },
          {
            "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-02-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "70925",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/70925"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
        },
        {
          "name": "46311",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/46311"
        },
        {
          "name": "43261",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43261"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
        },
        {
          "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
        },
        {
          "name": "ADV-2011-0373",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0373"
        },
        {
          "name": "1025065",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1025065"
        },
        {
          "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:12581",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
        },
        {
          "name": "8091",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8091"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
        },
        {
          "name": "ADV-2011-0426",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0426"
        },
        {
          "name": "43334",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43334"
        },
        {
          "name": "continuum-unspec-xss(65343)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
        },
        {
          "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://continuum.apache.org/security.html"
        },
        {
          "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-0533",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "70925",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/70925"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
            },
            {
              "name": "46311",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/46311"
            },
            {
              "name": "43261",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43261"
            },
            {
              "name": "http://jira.codehaus.org/browse/CONTINUUM-2604",
              "refsource": "CONFIRM",
              "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
            },
            {
              "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "MLIST",
              "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360@apache.org%3E"
            },
            {
              "name": "ADV-2011-0373",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0373"
            },
            {
              "name": "1025065",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1025065"
            },
            {
              "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:12581",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
            },
            {
              "name": "8091",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8091"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
            },
            {
              "name": "ADV-2011-0426",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0426"
            },
            {
              "name": "43334",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43334"
            },
            {
              "name": "continuum-unspec-xss(65343)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
            },
            {
              "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
            },
            {
              "name": "http://continuum.apache.org/security.html",
              "refsource": "CONFIRM",
              "url": "http://continuum.apache.org/security.html"
            },
            {
              "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-0533",
    "datePublished": "2011-02-17T17:00:00.000Z",
    "dateReserved": "2011-01-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T21:58:25.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}