Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

2,330 results · Clear filters · Feed

  • High 7.1
    CVE-2015-0266

    Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

    The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.

    org.apache.ranger:ranger Maven
  • High 8.8
    CVE-2016-0735

    Apache Ranger Access Restriction Bypass

    Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.

    org.apache.ranger:ranger Maven
  • High 8.8
    CVE-2016-0710 Public exploit EPSS 52%

    Apache Jetspeed vulnerable to SQL Injection

    Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

    org.apache.portals.jetspeed-2:jetspeed Maven
  • High 7.2
    CVE-2016-0709 Public exploit EPSS 77%

    Path Traversal in Apache Jetspeed

    Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a…

    org.apache.portals.jetspeed-2:jetspeed Maven
  • High 7.5
    CVE-2016-2164

    Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

    The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitra…

    org.apache.openmeetings:openmeetings-parent Maven
  • High 8.8
    CVE-2016-0792 Public exploit EPSS 83%

    Jenkins allows Deserialization of Untrusted Data via an XML File

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.1
    CVE-2016-2510 EPSS 70%

    Improper Input Validation in BeanShell

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

    bsh org.apache-extras.beanshell:bsh bsh Debian Ubuntu Maven
  • High 7.5
    CVE-2016-0793 Public exploit EPSS 15%

    WildFly has incomplete blacklist vulnerability

    Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a…

    org.wildfly:wildfly-parent org.wildfly:wildfly-undertow Maven
  • High 8.1
    CVE-2015-5346 EPSS 11%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack we…

    org.apache.tomcat:tomcat tomcat7 Ubuntu Maven
  • High 8.8
    CVE-2015-5351

    Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mech…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 8.8
    CVE-2016-0714 Public exploit EPSS 13%

    Improper Access Control in Apache Tomcat

    The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 7.5
    CVE-2016-0956 Public exploit EPSS 51%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post

    The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

    org.apache.sling:org.apache.sling.servlets.post Maven
  • High 8.8
    CVE-2015-7537

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2015-7538

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.5
    CVE-2015-7539

    Jenkins does not Verify Checksums for Plugin Files

    The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.3
    CVE-2015-7521

    High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

    The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operation…

    org.apache.hive:hive-exec org.apache.hive:hive org.apache.hive:hive-service Maven
  • High 8.8
    CVE-2015-2912

    OrientDB-Server vulnerable to Cross-Site Request Forgery

    The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sen…

    com.orientechnologies:orientdb-studio Maven
  • High 7.3
    CVE-2015-1772

    Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

    The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows re…

    org.apache.hive:hive-exec org.apache.hive:hive org.apache.hive:hive-service Maven
  • High 7.3
    CVE-2015-1836

    High severity vulnerability that affects org.apache.hbase:hbase

    Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a …

    org.apache.hbase:hbase Maven
  • High 7.5
    CVE-2015-5317 Exploited EPSS 23%

    Jenkins discloses project names via fingerprints

    The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

    org.jenkins-ci.main:jenkins-core Maven
    KEV May 12, 2023
  • High —
    CVE-2014-3612

    Improper Authentication in Apache WSS4J

    The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an una…

    activemq activemq org.apache.activemq:activemq-broker org.apache.activemq:activemq-jaas Debian Ubuntu Maven
  • High —
    CVE-2014-1972

    Apache Tapestry Unsafe Object Storage

    Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

    org.apache.tapestry:tapestry-core Maven
  • High 7.5
    CVE-2014-3576 Public exploit EPSS 13%

    Improper Neutralization of Special Elements used in an OS Command in Apache ActiveMQ

    The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
  • High —
    CVE-2015-1831

    Incomplete exclude pattern in Apache Struts

    The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • High —
    CVE-2014-0230 EPSS 20%

    Uncontrolled Resource Consumption in Apache Tomcat

    Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread co…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High —
    CVE-2014-8125

    Improper Input Validation in Drools and jBPM

    XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

    org.drools:drools-core org.jbpm:jbpm-bpmn2 Maven
  • High —
    CVE-2015-0225

    Improper Neutralization of Special Elements used in a Command in Apache Cassandra

    The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI req…

    org.apache.cassandra:apache-cassandra Maven
  • High —
    CVE-2015-0254 EPSS 12%

    XXE in Apache Standard Taglibs

    Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

    jakarta-taglibs-standard org.apache.taglibs:taglibs-standard org.apache.taglibs:taglibs-standard-impl Ubuntu Maven
  • High —
    CVE-2012-6153

    Improper certificate validation in org.apache.httpcomponents:httpclient

    http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m…

    org.apache.httpcomponents:httpclient commons-httpclient Debian Maven
  • High —
    CVE-2014-3490

    Incorrect Privilege Assignment in RESTEasy

    RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote a…

    org.jboss.resteasy:resteasy-client Maven
  • High 8.1
    CVE-2014-3120 Exploited Public exploit Scanner template EPSS 89%

    Elasticsearch Improper Access Control vulnerability

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security pol…

    org.elasticsearch:elasticsearch Maven
    KEV Mar 25, 2022
  • High —
    CVE-2014-3530

    XML External Entity Reference in org.picketlink:picketlink-common

    The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and p…

    org.picketlink:picketlink-common Maven
  • High —
    CVE-2014-0116

    ClassLoader manipulation in Apache Struts

    CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted req…

    org.apache.struts:struts2-core Maven
  • High —
    CVE-2014-0114 Public exploit EPSS 99%

    Arbitrary code execution in Apache Commons BeanUtils

    Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…

    commons-beanutils:commons-beanutils commons-beanutils commons-beanutils Debian Ubuntu Maven
  • High —
    CVE-2013-7259

    Neo4J vulnerable to Cross-Site Request Forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/exe…

    org.neo4j:neo4j Maven
  • High —
    CVE-2014-0113 Public exploit EPSS 78%

    ClassLoader manipulation in Apache Struts

    CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted reque…

    org.apache.struts:struts2-core Maven
  • High —
    CVE-2014-0112 Public exploit EPSS 98%

    ClassLoader manipulation in Apache Struts

    ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists beca…

    org.apache.struts:struts2-core Maven
  • High —
    CVE-2014-1216 Public exploit

    Improper Neutralization of Special Elements used in a Command in FitNesse Wiki

    FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

    org.fitnesse:fitnesse Maven
  • High —
    CVE-2014-0107 EPSS 14%

    Improper Authorization in Apache Xalan-Java

    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access exte…

    xalan:xalan libxalan2-java Debian Maven
  • High —
    CVE-2014-2741

    Ignite Realtime Openfire vulnerable to XMPPbomb attack

    nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "x…

    org.igniterealtime.openfire:parent Maven