Ecosystem
Maven
7,126 known vulnerabilities.
Most affected packages
7,117 results · Feed
-
High 7.5CVE-2021-37304 Scanner template
Insecure Permissions issue in jeecg-boot
An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
-
High 7.5CVE-2021-37305 Scanner template
Insecure Permissions issue in jeecg-boot
An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.
-
Critical 9.8
Apache InLong: Jdbc Connection Security Bypass
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inl…
-
High 7.5
Apache InLong: Jdbc Connection causes arbitrary file reading in InLong
Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214 h…
-
Medium 6.5
Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, th…
-
High 8.8
Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicio…
-
Medium 5.3
http-cache-semantics vulnerable to Regular Expression Denial of Service
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
-
Critical 9.8
Dromara hutool vulnerable to SQL Injection
SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.
-
Critical 9.8
Dromara Hutool Deserialization of Untrusted Data vulnerability
Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
-
Medium 6.5
Path Traversal In Eclipse GlassFish
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such …
-
Critical 9.8
Remote Code Execution in com.bstek.uflo:uflo-core
All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.
-
Medium 4.7
Issue with whitespace in JWT roles in OpenSearch
OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are proces…
-
Medium 5.7
Field-level security issue with .keyword fields in OpenSearch
OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for cer…
-
Critical 9.8
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
-
High 8.8
CSRF vulnerability in Jenkins Orka Plugin allow capturing credentials
A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing creden…
-
Medium 6.5
Missing permission check in Jenkins BearyChat Plugin
A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
-
High 8.1
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).
-
Medium 4.3
Path Traversal in Jenkins visualexpert Plugin
Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller…
-
Medium 5.5
Plaintext storage of Access Token in Jenkins GitHub Pull Request Coverage Status Plugin
Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with a…
-
Critical 9.8
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
-
High 8.8
CSRF vulnerability in Jenkins TestQuality Updater Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
-
Medium 6.5
Missing permission checks in Jenkins Orka Plugin allow capturing credentials
Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing cr…
-
Critical 9.8
XML external entity vulnerability on agents in Jenkins MSTest Plugin
Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Medium 5.5
Cleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 4.3
Jenkins GitHub Pull Request Builder Plugin missing permission check allows enumerating credentials IDs
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.5
Missing permission checks in Jenkins GitHub Pull Request Builder Plugin
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi…
-
Critical 9.8
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins …
-
High 8.8
Cross-site request forgery vulnerability in Jenkins BearyChat Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL.
-
High 8.8
Insufficient Session Expiration in Jenkins Azure AD Plugin
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
-
Medium 6.5
CSRF vulnerability in Jenkins Keycloak Authentication Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account.
-
Medium 6.5
Missing permission check in Jenkins TestQuality Updater Plugin
A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
-
High 8.8
Cross-site request forgery vulnerability in Jenkins RabbitMQ Consumer Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
-
Medium 6.5
Missing permission check in Jenkins RabbitMQ Consumer Plugin
A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
-
High 8.8
CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing cre…
-
Medium 5.5
Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Critical 9.8
Session fixation vulnerability in Jenkins OpenID Plugin
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
-
High 8.8
Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
-
Medium 4.3
Path traversal vulnerability in Jenkins PWauth Security Realm Plugin
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins con…
-
Medium 6.5
Passwords stored in plain text by Jenkins view-cloner Plugin
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
-
Medium 4.3
Missing permission checks in Jenkins Orka Plugin allow enumerating credentials IDs
A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.