Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

218 results · Clear filters · Feed

  • Critical 9.8
    CVE-2017-11467 Public exploit EPSS 73%

    OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

    OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

    com.orientechnologies:orientdb-core Maven
  • Critical 9.8
    CVE-2016-6798 Public exploit

    XML External Entity Reference in Apache Sling

    In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowi…

    Apache Software Foundation Apache Sling org.apache.sling:org.apache.sling.xss.compat org.apache.sling:org.apache.sling.xss Maven
  • Critical 9.8
    CVE-2017-9791 Exploited Public exploit Scanner template EPSS 99%

    Code execution in Apache Struts 1 plugin

    The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-struts1-plugin Maven
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2016-2173 Public exploit

    Improper Input Validation in Spring AMQP

    org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

    org.springframework.amqp:spring-amqp Maven
  • Critical 9.8
    CVE-2017-5645 Public exploit Scanner template EPSS 89%

    Deserialization of Untrusted Data in Log4j

    In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-5638 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-9299 Public exploit EPSS 97%

    Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

    The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

    org.jenkins-ci.main:jenkins-core Maven
  • Critical 9.8
    CVE-2016-4438 Public exploit EPSS 17%

    Arbitrary code execution in Apache Struts 2

    The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

    org.apache.struts:struts2-core org.apache.struts:struts2-rest-plugin Maven
  • Critical 9.8
    CVE-2016-3087 Public exploit EPSS 82%

    Apache Struts vulnerable to arbitrary remote code execution due to improper input validation

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

    org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-3088 Exploited Public exploit Scanner template EPSS 98%

    Improper Input Validation in Apache ActiveMQ

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2015-5254 Public exploit EPSS 38%

    Improper Input Validation in Apache ActiveMQ

    Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
  • Critical 9.8
    CVE-2015-6420 Public exploit EPSS 24%

    Insecure Deserialization in Apache Commons Collection

    Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switchin…

    net.sourceforge.collections:collections-generic org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections commons-collections:commons-collections org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic Maven
  • Critical 9.8
    CVE-2015-8103 Public exploit EPSS 92%

    Jenkins CLI Deserialization of Untrusted Data vulnerability

    The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy v…

    org.jenkins-ci.main:cli Maven
  • Critical 9.8
    CVE-2015-1427 Exploited Public exploit Scanner template EPSS 100%

    Improper Access Control in Elasticsearch

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    org.elasticsearch:elasticsearch Maven
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2013-2251 Exploited Public exploit Scanner template EPSS 100%

    Code injection in Apache Struts

    Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

    org.apache.struts:struts2-core Maven
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2012-0391 Exploited Public exploit EPSS 76%

    Apache Struts Remote Java Code Execution

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a craf…

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
    KEV Jan 21, 2022
  • Critical 9.8
    CVE-2009-3555 Public exploit EPSS 87%

    Apache Tomcat affected by vulnerability in TLS and SSL protocol

    The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…

    openssl apache2 org.apache.tomcat:tomcat nss Debian Maven