gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.0.0.final), io.quarkus:io.quarkus.gradle.plugin (1.0.0.final) +192 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.0.0.final)

io.quarkus:quarkus-core MAVEN version 1.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.0.0.final - io.quarkus:io.quarkus.gradle.plugin 1.0.0.fina...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.0.alpha1), io.quarkus:io.quarkus.gradle.plugin (1.3.0.alpha1) +211 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.3.0.alpha1)

io.quarkus:quarkus-core MAVEN version 1.3.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.0.alpha1 - io.quarkus:io.quarkus.gradle.plugin...

com.github.fmcejudo:quarkus-eureka (0.0.5), com.github.fmcejudo:quarkus-eureka-deployment (0.0.5) +420 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.0.1.final)

io.quarkus:quarkus-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - com.github.fmcejudo:quarkus-eureka 0.0.5 - com.github.fmcejudo:quarkus-eureka-deployment 0.0.5 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.4.final), io.quarkus:io.quarkus.gradle.plugin (1.3.4.final) +245 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.3.4.final)

io.quarkus:quarkus-core MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.4.final - io.quarkus:io.quarkus.gradle.plugin 1.3.4.fina...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.5.1.final), io.backpackcloud:fakeomatic (0.3.0) +311 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.5.1.final)

io.quarkus:quarkus-core MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.5.1.final - io.backpackcloud:fakeomatic 0.3.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.6.0.cr1), io.quarkus:io.quarkus.gradle.plugin (1.6.0.cr1) +310 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.6.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.6.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.6.0.cr1 - io.quarkus:io.quarkus.gradle.plugin 1.6.0.cr1 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.7.0.cr2), io.quarkus:io.quarkus.gradle.plugin (1.7.0.cr2) +326 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.7.0.cr2)

io.quarkus:quarkus-core MAVEN version 1.7.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.7.0.cr2 - io.quarkus:io.quarkus.gradle.plugin 1.7.0.cr2 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.11.5.final), io.quarkus:io.quarkus.gradle.plugin (1.11.5.final) +528 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.11.5.final)

io.quarkus:quarkus-core MAVEN version 1.11.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.11.5.final - io.quarkus:io.quarkus.gradle.plugin...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.13.0.cr1), io.quarkus:io.quarkus.gradle.plugin (1.13.0.cr1) +428 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.13.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.13.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.13.0.cr1 - io.quarkus:io.quarkus.gradle.plugin 1.13.0.cr1 -...

@adobe/git-server (>=1.0.1, <=1.0.5), @adobe/helix-cli (>=5.7.7, <=6.1.0) +33 more potentially affected by CVE-2022-22984 via snyk-gradle-plugin (>=3.1.0, <=3.24.2)

snyk-gradle-plugin NPM version =3.1.0, =1.0.1, =5.7.7, =2.16.1, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.5.8, =0.0.2, =0.0.7, =0.2.0-a1, =1.20.0-alpha.11736.3, =0.1.0, =0.1.1 and more Source cves: CVE-2022-22984 Source advisory: OSV:GHSA-4X6G-3CMX-W76R...

@adobe/git-server (>=1.0.1, <=1.0.5), @adobe/helix-cli (>=5.7.7, <=6.1.0) +33 more potentially affected by CVE-2022-22984 via snyk-gradle-plugin (>=3.1.0, <=3.24.2)

snyk-gradle-plugin NPM version =3.1.0, =1.0.1, =5.7.7, =2.16.1, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.5.8, =0.0.2, =0.0.7, =0.2.0-a1, =1.20.0-alpha.11736.3, =0.1.0, =0.1.1 and more Source cves: CVE-2022-22984 Source advisory: GHSA-4X6G-3CMX-W76R...

GHSA-4X6G-3CMX-W76R Snyk plugins vulnerable to Command Injection

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

CVE-2022-22984: Improper Neutralization of Special Elements used in an OS Command

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

PT-2022-15754 · Snyk · Snyk-Python-Plugin +7

Name of the Vulnerable Software and Affected Versions: snyk versions prior to 1.1064.0 snyk-mvn-plugin versions prior to 2.31.3 snyk-gradle-plugin versions prior to 3.24.5 @snyk/snyk-cocoapods-plugin versions prior to 2.5.3 snyk-sbt-plugin versions prior to 2.16.2 snyk-python-plugin versions prio...

CVE-2022-22984

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +67 more potentially affected by CVE-2022-22984 via snyk-gradle-plugin (>=1.0.2, <=3.24.2)

snyk-gradle-plugin NPM version =1.0.2, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.0.2, =0.0.7, =1.0.1 - @ericblade/quagga2-redux-middleware 1.0.1 and more Source cves: CVE-2022-22984 Source advisory: MEND:CVE-2022-22984...

org.jenkins-ci.plugins:gradle (>=1.37.1, <=1.40) potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.74)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.74 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:gradle =1.37.1, =1.40 Source cves: CVE-2022-43402...

org.jenkins-ci.plugins:gradle (>=1.37.1, <=1.40) potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.74)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.74 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:gradle =1.37.1, =1.40 Source cves: CVE-2022-43404...

@adobe/git-server (>=1.0.1, <=1.0.5), @adobe/helix-cli (>=5.7.7, <=6.1.0) +33 more potentially affected by CVE-2022-22984 +1 more via snyk-gradle-plugin (>=3.1.0, <=3.24.2)

snyk-gradle-plugin NPM version =3.1.0, =1.0.1, =5.7.7, =2.16.1, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.5.8, =0.0.2, =0.0.7, =0.2.0-a1, =1.20.0-alpha.11736.3, =0.1.0, =0.1.1 and more Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory: SNYK:JS-SNYKGRADLEPLUGIN-3038624...

Command Injection

Overview snyk-gradle-plugin is a plugin for the Snyk CLI tool, providing dependency metadata for Gradle projects. Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on t...