batik: Server-Side Request Forgery vulnerability

A flaw was found in Apache Batik 1.0 - 1.16. This issue occurs due to a malicious SVG triggering external resources loading by default, causing resource consumption or in some cases information disclosure...

batik: Server-Side Request Forgery vulnerability

A flaw was found in Apache Batik, where a malicious SVG can probe user profile data and send it directly as parameter to a URL. This issue can allow an attacker to conduct SSRF attacks...

Security Bulletin: There are several vulnerabilities in Apache Batik used by IBM Jazz Reporting Service (CVE-2022-40146, CVE-2022-38648, CVE-2022-38398)

Summary There are several vulnerabilities in Apache Batik used by IBM Jazz Reporting ServiceJRS. This vulnerabiliity is addressed in JRS by upgrading to a version of Apache Batik that resolves the issue. Vulnerability Details CVEID:CVE-2022-40146 DESCRIPTION: Apache Batik is vulnerable to...

Security Bulletin: There is a vulnerability in Apache Batik used by IBM Jazz Reporting Service

Summary There is a vulnerability in Apache Batik used by IBM Jazz Reporting ServiceJRS. This vulnerabiliity is addressed in JRS by upgrading to a version of Apache Batik that resolves the issue. Vulnerability Details CVEID:CVE-2019-17566 DESCRIPTION: Apache Batik is vulnerable to server-side...

Security Bulletin: The IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit are vulnerable to a server-side request forgery due to Apache Batik (CVE-2022-44730, CVE-2022-44729)

Summary The IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit are vulnerable to a server-side request forgery due to Apache Batik CVE-2022-44730, CVE-2022-44729. Vulnerability Details CVEID:CVE-2022-44730 DESCRIPTION: Apache Batik is vulnerable to server-side request forgery,...

Security Bulletin: Vulnerabilities in batik-all library affects IBM Engineering Test Management (ETM) (CVE-2022-44730, CVE-2022-44729)

Summary This Security Vulnerablity has been addressed in IBM Engineering Test Management. A fix is available to address the vulnerability. Vulnerability Details CVEID:CVE-2022-44730 DESCRIPTION: Apache Batik is vulnerable to server-side request forgery, caused by improper input validation. By...

OESA-2023-1651 batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function. Security Fixes: Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protoco...

Security Bulletin: Multiple vulnerabilities in Apache Batik affect IBM Application Performance Management products

Summary Apache Batik is used by IBM Application Performance Management. Vulnerability Details CVEID:CVE-2022-40146 DESCRIPTION: Apache Batik is vulnerable to server-side request forgery, caused by a flaw in the DefaultScriptSecurity function. By sending a specially-crafted request, an attacker...

Security Bulletin: Multiple vulnerabilities in apache batik affect IBM Application Performance Management products.

Summary Apache batik is used by IBM Application Performance Management. Vulnerability Details CVEID:CVE-2019-17566 DESCRIPTION: Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an...

Security Bulletin: Vulnerabilities found in batik-bridge-1.7.jar which is shipped with IBM® Intelligent Operations Center(CVE-2022-40146, CVE-2022-38648, CVE-2022-38398)

Summary Multiple vulnerabilities have been identified in batik-bridge-1.7.jar which is shipped with IBM® Intelligent Operations Center. Information about these vulnerabilities affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs. Vulnerability Details...

Security Bulletin: Vulnerabilities found in batik-all-1.7.jar, batik-dom-1.7.jar which is shipped with IBM® Intelligent Operations Center(CVE-2018-8013, CVE-2017-5662, CVE-2015-0250)

Summary Multiple vulnerabilities have been identified in batik-all-1.7.jar, batik-dom-1.7.jar which is shipped with IBM® Intelligent Operations Center. Information about these vulnerabilities affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs...

CVE-2022-44730

A flaw was found in Apache Batik, where a malicious SVG can probe user profile data and send it directly as parameter to a URL. This issue can allow an attacker to conduct SSRF attacks...

CVE-2022-44729

A flaw was found in Apache Batik 1.0 - 1.16. This issue occurs due to a malicious SVG triggering external resources loading by default, causing resource consumption or in some cases information disclosure...

Server-Side Request Forgery (SSRF)

Apache XML Graphics Batik is vulnerable to Server-Side Request Forgery SSRF. An attacker is able to trick the application into loading a malicious SVG file, which could then be used to cause excess resource consumption or make unauthorized requests to other systems...

ai.tock:tock-shared (>=19.9.4 <=26.3.2), at.austriapro:ebinterface-rendering (>=1.0.0 <=1.0.1) +1503 more potentially affected by CVE-2022-44730 via org.apache.xmlgraphics:batik-script (>=1.10 <=1.16)

org.apache.xmlgraphics:batik-script MAVEN version =1.10, =19.9.4, =1.0.0, =1.0.7, =0.2.1, =0.5.0, =0.11.1, =0.0.2, =0.0.1, =0.0.1, =25.6.0, =25.12.0 and more Source cves: CVE-2022-44730 Source advisory: OSV:GHSA-2474-2566-3QXP...

ai.tock:tock-shared (>=19.9.4 <=26.3.2), at.austriapro:ebinterface-rendering (>=1.0.0 <=1.0.1) +1501 more potentially affected by CVE-2022-44729 via org.apache.xmlgraphics:batik-bridge (>=1.10 <=1.16)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.10, =19.9.4, =1.0.0, =1.0.7, =0.2.1, =0.5.0, =0.11.1, =0.0.2, =0.0.1, =0.0.1, =25.6.0, =25.12.0 and more Source cves: CVE-2022-44729 Source advisory: OSV:GHSA-GQ5F-XV48-2365...

ai.tock:tock-shared (>=19.9.4 <=26.3.2), at.datenwort.openhtmltopdf:openhtmltopdf-latex-support (=1.1.3) +1444 more potentially affected by CVE-2022-44729 via org.apache.xmlgraphics:batik-transcoder (>=1.10 <=1.16)

org.apache.xmlgraphics:batik-transcoder MAVEN version =1.10, =19.9.4, =0.2.1, =0.5.0, =0.11.1, =0.0.2, =0.0.2, =1.3.5, =0.2.4, =0.4.6 - ch.exense.step:step-functions-plugins-jmeter-local-handler =3.30.0 and more Source cves: CVE-2022-44729 Source advisory: OSV:GHSA-GQ5F-XV48-2365...

GHSA-GQ5F-XV48-2365 Apache XML Graphics Batik Server-Side Request Forgery vulnerability

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even...

GHSA-2474-2566-3QXP Apache Batik information disclosure vulnerability

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL...

bio.ferlab:obo-parser_2.12 (=1.3.1), camp.xit.jacod:jacod-provider-xlsx (>=1.3.5 <=1.3.7) +536 more potentially affected by CVE-2022-44729 via org.apache.xmlgraphics:batik-svgrasterizer (>=1.10 <=1.16)

org.apache.xmlgraphics:batik-svgrasterizer MAVEN version =1.10, =1.3.5, =1.1.0, =2021.8.0, =4.20.0, =0.0.1, =1.0.0, =2.0.2, =2.0.2, =2.1.0, =3-BETA9, =3.0.0-beta3 and more Source cves: CVE-2022-44729 Source advisory: OSV:GHSA-GQ5F-XV48-2365...