Weakness (CWE)
CWE-1104: Use of Unmaintained Third Party Components
The product relies on third-party components that are not
actively supported or maintained by the original developer or a trusted proxy
for the original developer.
Source: MITRE CWE-1104
33 results · Feed
-
Medium 6.9
Use of End-of-Life components in mH-DEVELOPER
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit …
-
Medium 4.2
HCL Hive is affected by multiple security vulnerabilities.
HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment.
-
High 8.5
HP Easy Start for macOS - Security Update
Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
-
High 7.5
HCL Hive is affected by a use of vulnerable third-party components
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.
-
Critical 9.9
Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows…
-
High 8.8
cloudflare/pages-action is deprecated — migration required by September 18th, 2026
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitati…
-
Critical 9.8
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrust…
-
High 8.8
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
Low 2.2
HCL MyCloud was affected by Using Components with Known Vulnerability
HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.
-
Critical 9.8
Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library
Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.
-
High 7.7
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly kn…
-
High 8.3
HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and…
-
High 8.7
Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection
Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox an…
-
Low 2.6
HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability
HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits available across the internet and craft attacks against the application.
-
High 7.8
Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 wit…
-
Critical 10.0
Incorrect Content-Type Header
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
-
Low 3.5
HCL MyXalytics is affected by the use of vulnerable/outdated versions
HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
-
High 7.1
Vasion Print (formerly PrinterLogic) Insecure Windows Components Lack Modern Memory Protections and Use Outdated Runtimes
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client components (PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLaunch…
-
Critical 9.3
Vasion Print (formerly PrinterLogic) Usage of Outdated and Unsupported OpenSSL Version
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips (released May 2016), which has been end-of-life since 201…
-
Critical 9.8
Outdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4
Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable th…
-
High 7.1
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup f…
-
High 8.7
Radiflow iSAP Smart Collector Linux distribution unmaintained
The Linux distribution underlying the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) is obsolete and reached end of life (EOL) on June 30, 2024. Thus, any unmitigated vulnerability could be exploited to affect this product.
-
Critical 9.8
BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities
BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS im…
-
High 8.8
CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the devi…
-
High 8.8
A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 an…
-
High 7.5
Azure Storage Movement Client Library Denial of Service Vulnerability
Azure Storage Movement Client Library Denial of Service Vulnerability
-
Medium 6.5
Integer overflow in URI leading to potential host spoofing
Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs. This vulnerability does not a…
-
Unscored —
Remote Code Execution (RCE) Vulnerability
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable lo…
-
Medium 6.6
Kibana Reporting vulnerabilities
Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage k…
-
High 8.8
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability a…
-
Critical —
typemap is Unmaintained
The maintainer seems unreachable. The crate may or may not be usable as-is despite no maintenance and may not work in future versions of Rust. The last release seems to have been seven years ago.
-
Critical —
traitobject is Unmaintained
Crate `traitobject` has not had a release for over five years. In addition there is an existing security advisory that has not been addressed: - [RUSTSEC-2020-0027](https://rustsec.org/advisories/RUSTSEC-2020-0027) ## Possible Alternative(s) The below list ha…
-
Medium 5.3
Outdated Static Dependency in vue-moment
Versions of `vue-moment` prior to 4.1.0 contain an Outdated Static Dependency. The package depends on `moment` and has it loaded statically instead of as a dependency that can be updated. It has `moment@2.19.1` that contains a Regular Expression Denial of Ser…