Ecosystem
Maven
7,126 known vulnerabilities.
Most affected packages
7,117 results · Feed
-
High 7.5CVE-2019-12422 Public exploit
Improper input validation in Apache Shiro
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
-
Medium 6.1
Jenkins CI Game Plugin allows Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.
-
Medium 6.1
Jenkins Violation Plugin allows Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin.
-
Medium 6.1
Jenkins allows Cross-Site Scripting (XSS) via Crafted URL
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.
-
Critical 9.8
Unrestricted upload of file with dangerous type in Apache Solr
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, the…
-
High 8.8
Jenkins allows Data Insertion and Execution of Code by those with Read and HTTP Access
Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
-
Medium 6.1CVE-2019-10070 Public exploit
Stored XSS in Apache Atlas
Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
-
Medium 5.9
Improper Restriction of XML External Entity Reference in jackson-mapper-asl
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
-
Medium 6.1
Reflected Cross site scripting (XSS) in kairosdb
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
-
Medium 4.3
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
-
Medium 6.5
HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
-
Medium 6.5CVE-2019-10219 Public exploit
The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
-
Critical 9.8CVE-2019-12419 EPSS 14%
Potential session hijack in Apache CXF
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to…
-
Medium 6.5
Potential DOS attack due to unrestricted attachment count in messages
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of m…
-
High 7.5
Play Framework Inadequate Encryption Strength vulnerability
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy cred…
-
Critical 9.8
Struts ParameterInterceptor vulnerability allows remote command execution
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.
-
High 7.5CVE-2019-0205 Public exploit
Loop with Unreachable Exit Condition in Apache Thrift
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects o…
-
High 7.5
Hadoop symlink vulnerability
Hadoop 1.0.3 contains a symlink vulnerability.
-
Critical 9.8
Ignite Realtime Openfire vulnerable to Server Side Request Forgery
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
-
Medium 5.3
Ignite Realtime Openfire directory traversal vulnerability
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
-
Medium 5.5
Improper Restriction of XML External Entity Reference in Apache POI
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External E…
-
High 7.8
Jenkins Zulip Plugin vulnerable to Insufficiently Protected Credentials
Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins Global Post Script Plugin missing permission check
A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.
-
Medium 6.1
Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
-
Medium 4.3
Jenkins Libvirt Slaves Plugin vlnerable to Credential Enumeration
A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 6.5
Jenkins Libvirt Slaves Plugin vlnerable to Incorrect Default Permissions
A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in …
-
High 8.8
Jenkins Libvirt Slaves Plugin vlnerable to Cross-Site Request Forgery
A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
-
Medium 6.5
Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
High 8.8
Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery
A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in…
-
Medium 6.5
Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credenti…
-
High 8.1
Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference
An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or den…
-
Medium 6.5
Jenkins Sonar Gerrit Plugin stores credentials unencrypted
Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
High 8.8
Jenkins Deploy WebLogic Plugin cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path exists on the …
-
Medium 4.3
Jenkins Deploy WebLogic Plugin missing permission check
A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path e…
-
Medium 6.5
Jenkins Dynatrace Plugin contains Incorrect Default Permissions
A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
High 8.1
Jenkins Dynatrace Plugin vulnerable to Cross-Site Request Forgery
A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.
-
High 7.8
Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials
Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
High 7.8
Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials
Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Medium 6.5
Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token
Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permissio…