Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

7,117 results · Feed

  • Medium 5.9
    CVE-2019-1003019

    GitHub Authentication Plugin session fixation vulnerability

    An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

    Jenkins Project Jenkins GitHub Authentication Plugin org.jenkins-ci.plugins:github-oauth Web / CMS Maven
  • High 7.4
    CVE-2019-1003009

    Jenkins Active Directory Plugin Improper certificate validation with StartTLS

    An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm…

    Jenkins Project Jenkins Active Directory Plugin org.jenkins-ci.plugins:active-directory Web / CMS Maven
  • High 7.5
    CVE-2019-6986

    Command Injection in VIVO Vitro

    SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request.

    org.vivoweb:vitro-project Maven
  • Medium 6.1
    CVE-2019-6804 Public exploit

    Rundeck Community Edition vulnerable to Cross-site Scripting

    An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.

    org.rundeck:rundeck Maven
  • Medium 6.5
    CVE-2018-1000997

    Improper Limitation of a Pathname to a Restricted Directory in Jenkins

    A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/s…

    org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Maven
  • High 8.8
    CVE-2019-1003002 Public exploit EPSS 81%

    Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability

    A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to p…

    Jenkins Project Pipeline: Declarative Plugin org.jenkinsci.plugins:pipeline-model-definition Maven
  • High 8.8
    CVE-2019-1003001 Public exploit EPSS 86%

    Jenkins Groovy Plugin sandbox bypass vulnerability

    A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers wit…

    Jenkins Project Pipeline: Groovy Plugin org.jenkins-ci.plugins:script-security org.jenkins-ci.plugins:pipeline-model-definition Maven
  • High 7.2
    CVE-2019-1003003

    Improper Authorization in Jenkins Core

    An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • High 8.8
    CVE-2019-1003000 Public exploit Scanner template EPSS 98%

    Protection Mechanism Failure in Jenkins Script Security Plugin

    A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary c…

    Jenkins Project Script Security Plugin org.jenkins-ci.plugins:script-security Maven
  • High 7.2
    CVE-2019-1003004

    Improper Authorization in Jenkins Core

    An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely e…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Low —
    CVE-2019-3772

    Spring Integration XML External Entity Injection (XXE)

    Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

    Spring Spring Integration org.springframework.integration:spring-integration-xml org.springframework.integration:spring-integration-ws Maven
  • Low —
    CVE-2019-3774

    Spring Batch XML External Entity Injection (XXE)

    Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

    Spring Spring Batch org.springframework.batch:spring-batch-core Maven
  • Critical 9.8
    CVE-2019-3773

    Spring Web Services XML External Entity Injection (XXE)

    Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

    Spring Spring Web Services org.springframework.ws:spring-xml org.springframework.ws:spring-ws Maven
  • Medium 6.5
    CVE-2018-1000422

    Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability

    An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specifi…

    org.jenkins-ci.plugins:crowd2 Maven
  • Medium 6.5
    CVE-2018-1000411

    Jenkins JUnit Plugin CSRF vulnerability

    A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

    org.jenkins-ci.plugins:junit Maven
  • Medium 6.5
    CVE-2018-1000420

    Improper authorization vulnerability in Jenkins Mesos Plugin

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

    org.jenkins-ci.plugins:mesos Maven
  • High 7.8
    CVE-2018-1000410

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java t…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000426

    Stored XSS vulnerability in Jenkins Git Changelog Plugin

    A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPubl…

    de.wellnerbou.jenkins:git-changelog Maven
  • Medium 6.5
    CVE-2018-1000421

    Server-side request forgery vulnerability in Jenkins Mesos Plugin

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials…

    org.jenkins-ci.plugins:mesos Maven
  • Medium 6.5
    CVE-2018-1000408

    Improper Authorization in Jenkins

    A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances us…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000407

    Cross-site Scripting in Jenkins

    A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenki…

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.8
    CVE-2018-1000424

    Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

    An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the p…

    org.jenkins-ci.plugins:artifactory Maven
  • Medium 6.5
    CVE-2018-1000419

    Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

    org.jvnet.hudson.plugins:hipchat Maven
  • High 7.8
    CVE-2018-1000425

    Jenkins SonarQube Scanner Plugin stored server authentication token in plain text

    An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

    org.jenkins-ci.plugins:sonar Maven
  • Medium 6.5
    CVE-2018-1000406

    Path Traversal in Jenkins

    A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the …

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2018-1000418

    Jenkins HipChat Plugin allows credential capture due to incorrect authorization

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified creden…

    org.jvnet.hudson.plugins:hipchat Maven
  • High 7.8
    CVE-2018-1000423

    Jenkins Crowd 2 Integration Plugin stored credentials in plain text

    An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used …

    org.jenkins-ci.plugins:crowd2 Maven
  • Medium 5.4
    CVE-2018-1000415

    Cross-site Scripting in Jenkins Rebuilder Plugin

    A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.…

    com.sonyericsson.hudson.plugins.rebuild:rebuild Maven
  • High 8.1
    CVE-2018-1000414

    CSRF vulnerability in Config File Provider Plugin

    A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.

    org.jenkins-ci.plugins:config-file-provider Maven
  • Medium 5.4
    CVE-2018-1000413

    Stored XSS vulnerability in Config File Provider Plugin

    A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.

    org.jenkins-ci.plugins:config-file-provider Maven
  • High 8.1
    CVE-2018-1000417

    CSRF vulnerability in Email Extension Template Plugin

    A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.

    org.jenkins-ci.plugins:email-ext Maven
  • Medium 4.2
    CVE-2018-1000412

    Jenkins Jira Plugin Incorrect Authorization vulnerability

    An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained thro…

    org.jenkins-ci.plugins:jira Maven
  • Medium 5.4
    CVE-2018-1000409

    Session Fixation in Jenkins

    A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a use…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000416

    Jenkins Job Config History Plugin reflected XSS vulnerability

    A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.

    org.jenkins-ci.plugins:jobConfigHistory Maven
  • Medium 6.1
    CVE-2018-20676

    XSS vulnerability that affects bootstrap

    In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

    twitter-bootstrap3 bootstrap twitter-bootstrap3 bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems
  • Medium 6.1
    CVE-2018-20677

    bootstrap Cross-site Scripting vulnerability

    In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

    ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems
  • Medium 6.1
    CVE-2016-10735 Public exploit

    Bootstrap Cross-site Scripting vulnerability

    In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

    bootstrap twitter-bootstrap3 twitter-bootstrap3 bootstrap-sass Debian Ubuntu npm Packagist Maven NuGet RubyGems
  • Medium 6.5
    CVE-2018-11798

    Apache Thrift Node.js static web server sandbox escape

    The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

    Apache Software Foundation Apache Thrift druid trino Debian Wolfi Maven
  • High 7.5
    CVE-2018-1320

    Improper Input Validation in Apache Thrift

    Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be di…

    Apache Software Foundation Apache Thrift druid druid-compat Debian Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2018-11788 Public exploit

    XML External Entity Reference in Apache Karaf

    Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitiga…

    Apache Software Foundation Apache Karaf org.apache.karaf.specs:org.apache.karaf.specs.java.xml Maven