org.drools:drools-camel-server (5.3.2.final), org.jbpm:jbpm-distribution (5.2.1.final) +3 more potentially affected by CVE-2014-8125 via org.jbpm:jbpm-bpmn2 (5.2.1.final)

org.jbpm:jbpm-bpmn2 MAVEN version 5.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jbpm:jbpm-bpmn2 and may be impacted: - org.drools:drools-camel-server 5.3.2.final - org.jbpm:jbpm-distribution 5.2.1.final - org.jbpm:jbpm-examples...

org.drools:drools-camel-server (5.3.5.final), org.jbpm:jbpm-distribution (5.2.5.final) +3 more potentially affected by CVE-2014-8125 via org.jbpm:jbpm-bpmn2 (5.2.5.final)

org.jbpm:jbpm-bpmn2 MAVEN version 5.2.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jbpm:jbpm-bpmn2 and may be impacted: - org.drools:drools-camel-server 5.3.5.final - org.jbpm:jbpm-distribution 5.2.5.final - org.jbpm:jbpm-examples...

org.jbpm:jbpm-distribution (5.3.0.cr1), org.jbpm:jbpm-examples (5.3.0.cr1) +1 more potentially affected by CVE-2014-8125 via org.jbpm:jbpm-bpmn2 (5.3.0.cr1)

org.jbpm:jbpm-bpmn2 MAVEN version 5.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jbpm:jbpm-bpmn2 and may be impacted: - org.jbpm:jbpm-distribution 5.3.0.cr1 - org.jbpm:jbpm-examples 5.3.0.cr1 - org.jbpm:jbpm-test 5.3.0.cr1 Source cves:...

org.drools:drools-camel-server (5.4.0.final), org.drools:drools-simulator (5.4.0.final) +7 more potentially affected by CVE-2014-8125 via org.jbpm:jbpm-bpmn2 (5.3.0.final)

org.jbpm:jbpm-bpmn2 MAVEN version 5.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jbpm:jbpm-bpmn2 and may be impacted: - org.drools:drools-camel-server 5.4.0.final - org.drools:drools-simulator 5.4.0.final -...

org.drools:drools-camel-server-example (5.6.0.cr1), org.drools:drools-simulator (5.6.0.cr1) +12 more potentially affected by CVE-2014-8125 via org.jbpm:jbpm-bpmn2 (5.5.0.cr1)

org.jbpm:jbpm-bpmn2 MAVEN version 5.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jbpm:jbpm-bpmn2 and may be impacted: - org.drools:drools-camel-server-example 5.6.0.cr1 - org.drools:drools-simulator 5.6.0.cr1 -...

org.infinispan:infinispan-distribution (9.0.0.beta1), org.infinispan:infinispan-javadoc-all (9.0.0.beta1) +26 more potentially affected by CVE-2016-6347 via org.jboss.resteasy:resteasy-client (>=3.1.0.beta1, <=3.1.0.beta2)

org.jboss.resteasy:resteasy-client MAVEN version =3.1.0.beta1, =5.3.4.final, =5.3.4.final, =3.1.0.beta1, =3.1.0.beta1, =3.1.0.beta1, =3.1.0.beta1, =3.1.0.beta1, =3.1.0.beta1, =3.1.0.beta1, =3.1.0.beta2 and more Source cves: CVE-2016-6347 Source advisory: GHSA-R346-RMRG-QPGH...

Users Can Game Yield Distributions

Lines of code Vulnerability details Impact processYield restricts who can call this function to just the vault admin. Upon being processed, the treasury receives its fair share of the yield and the rest is transferred to the YieldManager.sol contract. To distribute yield, the manager calls...

YieldManager: Uniswap token swaps through fixed path may break yield distribution

Lines of code Vulnerability details Details & Impact All harvested yield tokens are swapped through the Uniswap adapter to USDC. While out of scope, the Uniswap adapter code is relevant here, as I note that the path taken for the swap would be assetFrom - WETH - assetTo unless assetFrom is alread...

org.ocpsoft.rewrite:rewrite-distribution (>=2.0.0.alpha2, <=2.0.0.alpha6), org.ocpsoft.rewrite:rewrite-transform-markup (>=1.1.0.final, <=2.0.0.alpha6) potentially affected by CVE-2018-1000079 via org.jruby:jruby-stdlib (1.6.7.2)

org.jruby:jruby-stdlib MAVEN version 1.6.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite:rewrite-distribution =2.0.0.alpha2, =1.1.0.final, =2.0.0.alpha6 Source cves: CVE-2018-1000079...

org.ocpsoft.rewrite.showcase:rewrite-showcase-transform (2.0.0.beta1), org.ocpsoft.rewrite:rewrite-distribution (2.0.0.beta1) +1 more potentially affected by CVE-2018-1000079 via org.jruby:jruby-stdlib (1.6.8)

org.jruby:jruby-stdlib MAVEN version 1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite.showcase:rewrite-showcase-transform 2.0.0.beta1 - org.ocpsoft.rewrite:rewrite-distribution...

org.cometd.java:cometd-java-demo (1.0.beta8), org.cometd.java:cometd-java-oort (1.0.beta8) +18 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.0.m1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-demo 1.0.beta8 - org.cometd.java:cometd-java-oort 1.0.beta8 -...

org.eclipse.jetty:jetty-ajp (7.0.0.m0), org.eclipse.jetty:jetty-annotations (7.0.0.m0) +13 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.0.m0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty:jetty-ajp 7.0.0.m0 - org.eclipse.jetty:jetty-annotations 7.0.0.m0 -...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.v20100505), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.v20100505) +34 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.1.0.v20100505)

org.eclipse.jetty:jetty-server MAVEN version 7.1.0.v20100505 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.v20100505 -...

org.ocpsoft.rewrite:rewrite-distribution (>=2.0.0.alpha2, <=2.0.0.alpha6), org.ocpsoft.rewrite:rewrite-transform-markup (>=1.1.0.final, <=2.0.0.alpha6) potentially affected by CVE-2018-1000076 via org.jruby:jruby-stdlib (1.6.7.2)

org.jruby:jruby-stdlib MAVEN version 1.6.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite:rewrite-distribution =2.0.0.alpha2, =1.1.0.final, =2.0.0.alpha6 Source cves: CVE-2018-1000076...

org.ocpsoft.rewrite.showcase:rewrite-showcase-transform (2.0.0.beta1), org.ocpsoft.rewrite:rewrite-distribution (2.0.0.beta1) +1 more potentially affected by CVE-2018-1000074 via org.jruby:jruby-stdlib (1.6.8)

org.jruby:jruby-stdlib MAVEN version 1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite.showcase:rewrite-showcase-transform 2.0.0.beta1 - org.ocpsoft.rewrite:rewrite-distribution...

org.ocpsoft.rewrite:rewrite-distribution (>=2.0.0.alpha2, <=2.0.0.alpha6), org.ocpsoft.rewrite:rewrite-transform-markup (>=1.1.0.final, <=2.0.0.alpha6) potentially affected by CVE-2018-1000074 via org.jruby:jruby-stdlib (1.6.7.2)

org.jruby:jruby-stdlib MAVEN version 1.6.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite:rewrite-distribution =2.0.0.alpha2, =1.1.0.final, =2.0.0.alpha6 Source cves: CVE-2018-1000074...

org.ocpsoft.rewrite.showcase:rewrite-showcase-transform (2.0.0.beta1), org.ocpsoft.rewrite:rewrite-distribution (2.0.0.beta1) +1 more potentially affected by CVE-2018-1000076 via org.jruby:jruby-stdlib (1.6.8)

org.jruby:jruby-stdlib MAVEN version 1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite.showcase:rewrite-showcase-transform 2.0.0.beta1 - org.ocpsoft.rewrite:rewrite-distribution...

org.ocpsoft.rewrite.showcase:rewrite-showcase-transform (2.0.0.beta1), org.ocpsoft.rewrite:rewrite-distribution (2.0.0.beta1) +1 more potentially affected by CVE-2018-1000078 via org.jruby:jruby-stdlib (1.6.8)

org.jruby:jruby-stdlib MAVEN version 1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite.showcase:rewrite-showcase-transform 2.0.0.beta1 - org.ocpsoft.rewrite:rewrite-distribution...

org.ocpsoft.rewrite.showcase:rewrite-showcase-transform (2.0.0.beta1), org.ocpsoft.rewrite:rewrite-distribution (2.0.0.beta1) +1 more potentially affected by CVE-2018-1000077 via org.jruby:jruby-stdlib (1.6.8)

org.jruby:jruby-stdlib MAVEN version 1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite.showcase:rewrite-showcase-transform 2.0.0.beta1 - org.ocpsoft.rewrite:rewrite-distribution...

org.ocpsoft.rewrite:rewrite-distribution (>=2.0.0.alpha2, <=2.0.0.alpha6), org.ocpsoft.rewrite:rewrite-transform-markup (>=1.1.0.final, <=2.0.0.alpha6) potentially affected by CVE-2018-1000077 via org.jruby:jruby-stdlib (1.6.7.2)

org.jruby:jruby-stdlib MAVEN version 1.6.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite:rewrite-distribution =2.0.0.alpha2, =1.1.0.final, =2.0.0.alpha6 Source cves: CVE-2018-1000077...