gg.jte.gradle:gg.jte.gradle.gradle.plugin (2.2.6), gg.jte:jte-gradle-plugin (2.2.6) +4 more potentially affected by CVE-2025-23026 via gg.jte:jte (2.2.6)

gg.jte:jte MAVEN version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on gg.jte:jte and may be impacted: - gg.jte.gradle:gg.jte.gradle.gradle.plugin 2.2.6 - gg.jte:jte-gradle-plugin 2.2.6 - gg.jte:jte-jsp-converter 2.2.6 - gg.jte:jte-kotlin 2.2.6...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=0.26.0, <=1.2.1.final), io.quarkus.http:quarkus-http-servlet (3.0.0.beta1) +25 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.beta1)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =0.26.0, =0.26.0, =0.26.0, =0.24.0,...

org.jenkins-ci.plugins:gradle (>=2.14, <=2.15) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3964.v0767b_4b_a_0b_fa)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3964.v0767b4ba0bfa is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:gradle =2.14, =2.15 Source cves:...

OS Command Injection

snyk-gradle-plugin is vulnerable to OS Command Injection. The vulnerability is due to the Snyk CLI's failure to correctly sanitize or validate the current working directory name, allowing for potential code injection when running scans on untrusted projects...

GHSA-QQQW-GM93-QF6M OS Command Injection in Snyk gradle plugin

The Snyk gradle plugin is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +68 more potentially affected by CVE-2024-48964 via snyk-gradle-plugin (>=1.0.2, <=3.27.0)

snyk-gradle-plugin NPM version =1.0.2, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.1.3, =0.0.2, =0.0.7, =1.0.1 and more Source cves: CVE-2024-48964 Source advisory: MEND:CVE-2024-48964...

Code Injection

Overview snyk-gradle-plugin is a plugin for the Snyk CLI tool, providing dependency metadata for Gradle projects. Affected versions of this package are vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrust...

com.cyclonedx:cyclonedx-gradle-plugin (>=1.1.2, <=1.5.0), com.free-now.sauron.plugins:dependency-checker (>=0.0.57, <=0.0.74) +55 more potentially affected by CVE-2024-38374 via org.cyclonedx:cyclonedx-core-java (>=2.1.1, <=9.0.3)

org.cyclonedx:cyclonedx-core-java MAVEN version =2.1.1, =1.1.2, =0.0.57, =1.0.0, =1.0.0, =1.0.0, =0.9.0, =0.9.0, =0.105.0, =0.9.0, =0.99.0, =0.9.0, =0.99.0, =0.9.0, =0.84.0, =0.99.0, =0.110.0 and more Source cves: CVE-2024-38374https://v...

com.cyclonedx:cyclonedx-gradle-plugin (>=1.1.2, <=1.5.0), com.free-now.sauron.plugins:dependency-checker (>=0.0.57, <=0.0.74) +55 more potentially affected by CVE-2024-38374 via org.cyclonedx:cyclonedx-core-java (>=2.1.1, <=9.0.3)

org.cyclonedx:cyclonedx-core-java MAVEN version =2.1.1, =1.1.2, =0.0.57, =1.0.0, =1.0.0, =1.0.0, =0.9.0, =0.9.0, =0.105.0, =0.9.0, =0.99.0, =0.9.0, =0.99.0, =0.9.0, =0.84.0, =0.99.0, =0.110.0 and more Source cves: CVE-2024-38374https://v...

com.cyclonedx:cyclonedx-gradle-plugin (>=1.1.2, <=1.5.0), com.free-now.sauron.plugins:dependency-checker (>=0.0.57, <=0.0.74) +55 more potentially affected by CVE-2024-38374 via org.cyclonedx:cyclonedx-core-java (>=2.1.1, <=9.0.3)

org.cyclonedx:cyclonedx-core-java MAVEN version =2.1.1, =1.1.2, =0.0.57, =1.0.0, =1.0.0, =1.0.0, =0.9.0, =0.9.0, =0.105.0, =0.9.0, =0.99.0, =0.9.0, =0.99.0, =0.9.0, =0.84.0, =0.99.0, =0.110.0 and more Source cves: CVE-2024-38374https://v...

SBOM support in Spring Boot 3.3

Spring Boot 3.3.0 has been released, and it contains support for SBOMs. SBOM stands for "Software Bill of Materials" and describes the components used to build a software artifact. In the context of this blog post, that's your Spring Boot application. These SBOMs are useful because they describe...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (0.28.0), io.quarkus:io.quarkus.gradle.plugin (0.28.0) +184 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (0.28.0)

io.quarkus:quarkus-core MAVEN version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 0.28.0 - io.quarkus:io.quarkus.gradle.plugin 0.28.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.1.0.final), io.quarkus:io.quarkus.gradle.plugin (1.1.0.final) +415 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.1.0.final)

io.quarkus:quarkus-core MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.1.0.final - io.quarkus:io.quarkus.gradle.plugin 1.1.0.fina...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.0.cr2), io.quarkus:io.quarkus.gradle.plugin (1.3.0.cr2) +245 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.3.0.cr2)

io.quarkus:quarkus-core MAVEN version 1.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.0.cr2 - io.quarkus:io.quarkus.gradle.plugin 1.3.0.cr2 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.0.cr1), io.quarkus:io.quarkus.gradle.plugin (1.3.0.cr1) +243 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.3.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.0.cr1 - io.quarkus:io.quarkus.gradle.plugin 1.3.0.cr1 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.4.final), io.quarkus:io.quarkus.gradle.plugin (1.3.4.final) +245 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.3.4.final)

io.quarkus:quarkus-core MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.4.final - io.quarkus:io.quarkus.gradle.plugin 1.3.4.fina...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.5.0.cr1), io.quarkus.extensions:quarkus-extension-catalog (>=1.0.0.alpha5, <=1.0.0.alpha12) +316 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.5.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.5.0.cr1 - io.quarkus.extensions:quarkus-extension-catalog...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.5.1.final), io.backpackcloud:fakeomatic (0.3.0) +311 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.5.1.final)

io.quarkus:quarkus-core MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.5.1.final - io.backpackcloud:fakeomatic 0.3.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.6.0.cr1), io.quarkus:io.quarkus.gradle.plugin (1.6.0.cr1) +310 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.6.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.6.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.6.0.cr1 - io.quarkus:io.quarkus.gradle.plugin 1.6.0.cr1 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.7.0.cr1), io.quarkus:io.quarkus.gradle.plugin (1.7.0.cr1) +326 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.7.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.7.0.cr1 - io.quarkus:io.quarkus.gradle.plugin 1.7.0.cr1 -...