Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

7,117 results · Feed

  • High 8.8
    CVE-2016-0710 Public exploit EPSS 52%

    Apache Jetspeed vulnerable to SQL Injection

    Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

    org.apache.portals.jetspeed-2:jetspeed Maven
  • Medium 6.1
    CVE-2016-0711

    Apache Jetspeed vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource.

    org.apache.portals.jetspeed-2:jetspeed-commons Maven
  • Medium 6.5
    CVE-2016-0784 Public exploit EPSS 55%

    Apache OpenMeetings Directory Traversal vulnerability

    Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.

    org.apache.openmeetings:openmeetings-install Maven
  • High 7.2
    CVE-2016-0709 Public exploit EPSS 77%

    Path Traversal in Apache Jetspeed

    Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a…

    org.apache.portals.jetspeed-2:jetspeed Maven
  • Medium 6.1
    CVE-2016-0712

    Cross-site Scripting in Apache Jetspeed

    Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.

    org.apache.portals.jetspeed-2:jetspeed Maven
  • High 7.5
    CVE-2016-2164

    Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

    The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitra…

    org.apache.openmeetings:openmeetings-parent Maven
  • Medium 6.1
    CVE-2016-2163

    Apache OpenMeetings Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating an event.

    org.apache.openmeetings:openmeetings-parent Maven
  • Critical 9.8
    CVE-2016-0791

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.3
    CVE-2016-0790

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2016-0792 Public exploit EPSS 83%

    Jenkins allows Deserialization of Untrusted Data via an XML File

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2016-0789

    Jenkins has CRLF Injection Vulnerability in the CLI

    CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Critical 9.8
    CVE-2016-0788 EPSS 12%

    Jenkins allows Execution of Code by Opening a JRMP Listener

    The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.1
    CVE-2016-2510 EPSS 70%

    Improper Input Validation in BeanShell

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

    bsh bsh org.apache-extras.beanshell:bsh Debian Ubuntu Maven
  • Medium 6.1
    CVE-2016-0734

    Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

    The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME e…

    org.apache.activemq:activemq-client Maven
  • High 7.5
    CVE-2016-0793 Public exploit EPSS 15%

    WildFly has incomplete blacklist vulnerability

    Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a…

    org.wildfly:wildfly-parent org.wildfly:wildfly-undertow Maven
  • High 8.1
    CVE-2015-5346 EPSS 11%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack we…

    org.apache.tomcat:tomcat tomcat7 Ubuntu Maven
  • Medium 4.3
    CVE-2015-5174 EPSS 13%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash d…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 5.3
    CVE-2015-5345 EPSS 18%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a direc…

    org.apache.tomcat:tomcat tomcat9 tomcat7 tomcat6 Ubuntu Maven
  • High 8.8
    CVE-2015-5351

    Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mech…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 8.8
    CVE-2016-0714 Public exploit EPSS 13%

    Improper Access Control in Apache Tomcat

    The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2016-0706

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticate…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 6.3
    CVE-2016-0763 EPSS 11%

    Improper Verification of Source of a Communication Channel in Apache Tomcat

    The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allow…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 6.1
    CVE-2015-8795

    Improper Neutralization of Input During Web Page Generation in Apache Solr

    Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp…

    org.apache.solr:solr-core Maven
  • Medium 6.1
    CVE-2015-8797

    Improper Neutralization of Input During Web Page Generation in Apache Solr

    Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.

    org.apache.solr:solr-core Maven
  • Medium 6.1
    CVE-2015-8796

    Apache Solr Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.

    org.apache.solr:solr Maven
  • High 7.5
    CVE-2016-0956 Public exploit EPSS 51%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post

    The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

    org.apache.sling:org.apache.sling.servlets.post Maven
  • High 8.8
    CVE-2015-7537

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2015-7538

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.4
    CVE-2015-7536

    Improper Neutralization of Input During Web Page Generation in Jenkins

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.5
    CVE-2015-7539

    Jenkins does not Verify Checksums for Plugin Files

    The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

    org.jenkins-ci.main:jenkins-core Maven
  • Critical 9.8
    CVE-2015-5344

    Camel-xstream component in Apache Camel can allow remote attackers to execute arbitrary commands

    The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

    org.apache.camel:camel-xstream Maven
  • High 8.3
    CVE-2015-7521

    High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

    The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operation…

    org.apache.hive:hive-exec org.apache.hive:hive org.apache.hive:hive-service Maven
  • Critical 9.8
    CVE-2015-5254 Public exploit EPSS 38%

    Improper Input Validation in Apache ActiveMQ

    Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
  • Medium 5.9
    CVE-2015-2913

    OrientDB Server Community Edition uses insufficiently random values to generate session IDs

    server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it …

    com.orientechnologies:orientdb-server Maven
  • Medium 6.1
    CVE-2015-2918

    OrientDB Studio web management interface is vulnerable to clickjacking attacks

    The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

    com.orientechnologies:orientdb-studio Maven
  • High 8.8
    CVE-2015-2912

    OrientDB-Server vulnerable to Cross-Site Request Forgery

    The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sen…

    com.orientechnologies:orientdb-studio Maven
  • High 7.3
    CVE-2015-1772

    Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

    The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows re…

    org.apache.hive:hive-exec org.apache.hive:hive org.apache.hive:hive-service Maven
  • High 7.3
    CVE-2015-1836

    High severity vulnerability that affects org.apache.hbase:hbase

    Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a …

    org.apache.hbase:hbase Maven
  • Critical 9.8
    CVE-2015-6420 Public exploit EPSS 24%

    Insecure Deserialization in Apache Commons Collection

    Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switchin…

    commons-collections:commons-collections org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic org.apache.commons:commons-collections4 net.sourceforge.collections:collections-generic Maven
  • Critical 9.8
    CVE-2015-8103 Public exploit EPSS 92%

    Jenkins CLI Deserialization of Untrusted Data vulnerability

    The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy v…

    org.jenkins-ci.main:cli Maven