biz.aqute.bnd:biz.aqute.bnd.maven (>=4.3.0, <=5.3.0), com.aerse.maven:apt-maven-plugin (>=1.19, <=1.20) +356 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.5.5)

org.codehaus.plexus:plexus-utils MAVEN version 1.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - biz.aqute.bnd:biz.aqute.bnd.maven =4.3.0, =1.19, =1.0, =2.0.0, =1.4.3, =1.4.3, =1.11.0, =1.11.0...

com.google.code.maven-svn-wagon:maven-svn-wagon (>=1.1, <=1.4), jp.pizzafactory.maven:s3-maven-wagon (3.3) +42 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.4.2)

org.codehaus.plexus:plexus-utils MAVEN version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - com.google.code.maven-svn-wagon:maven-svn-wagon =1.1, =3.2, =1.1.1, =1.0-alpha-2, =1.0-beta-3,...

org.apache.maven.plugins:maven-dependency-plugin (2.0-alpha-1), org.apache.maven.shared:maven-test-tools (1.0-alpha-1) +7 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.4-alpha-1)

org.codehaus.plexus:plexus-utils MAVEN version 1.4-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - org.apache.maven.plugins:maven-dependency-plugin 2.0-alpha-1 -...

au.net.causal.maven.native-security:natsec-maven-plugin (1.0), org.apache.maven.archiva:archiva-artifact-converter (>=1.0-alpha-1, <=1.0.2) +123 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.4)

org.codehaus.plexus:plexus-utils MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - au.net.causal.maven.native-security:natsec-maven-plugin 1.0 -...

au.com.alderaan:eclipselink-staticweave-maven-plugin (>=1.0.0, <=1.0.4), biz.paluch.maven.configurator:configurator-maven-plugin (>=1.0, <=1.0.1) +592 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.5.1)

org.codehaus.plexus:plexus-utils MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - au.com.alderaan:eclipselink-staticweave-maven-plugin =1.0.0, =1.0, =1.0.26, =1.3.2-snapshot,...

co.actioniq.thirdparty.com.twitter:scrooge-generator_2.10 (>=3.17.0-fda97c3c64755e87643b4700e3b9ac136f24e79d, <=3.17.0-4232bc888d6b09f0bf41930956b39dd8f398d96f), co.actioniq.thirdparty.com.twitter:scrooge-linter_2.10 (>=3.17.0-fda97c3c64755e87643b4700e3b9ac136f24e79d, <=3.17.0-4232bc888d6b09f0bf41930956b39dd8f398d96f) +87 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.5.4)

org.codehaus.plexus:plexus-utils MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - co.actioniq.thirdparty.com.twitter:scrooge-generator2.10...

com.anasoft.os:m2st-doxia-macros (2.0), com.soebes.maven.plugins.dmg:doxygen-maven-plugin (1.0.1) +54 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.5.7)

org.codehaus.plexus:plexus-utils MAVEN version 1.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - com.anasoft.os:m2st-doxia-macros 2.0 - com.soebes.maven.plugins.dmg:doxygen-maven-plugin 1.0.1 ...

org.ow2.util.maven:maven-deploymentplan-plugin (>=1.0.34, <=1.0.37), org.ow2.util.maven:maven-jbuilding-plugin (>=1.0.1, <=1.0.37) +7 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.4.8)

org.codehaus.plexus:plexus-utils MAVEN version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - org.ow2.util.maven:maven-deploymentplan-plugin =1.0.34, =1.0.1, =1.0.31, =1.0.13, =1.0.13,...

net.sf.mgp:maven-gwt-plugin (>=1.0, <=1.5.0), org.apache.portals.jetspeed-2:jetspeed-mvn-maven-plugin (>=2.2.0, <=2.3.1) potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.5)

org.codehaus.plexus:plexus-utils MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - net.sf.mgp:maven-gwt-plugin =1.0, =2.2.0, =2.3.1 Source cves: CVE-2017-1000487 Source advisory:...

com.buschmais.jqassistant.sonar:jqassistant.sonar.projectrules (>=1.1.3, <=1.1.4), com.buschmais.jqassistant.sonar:jqassistant.sonar.sonarrules (>=1.1.3, <=1.1.4) +369 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.4.1)

org.codehaus.plexus:plexus-utils MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - com.buschmais.jqassistant.sonar:jqassistant.sonar.projectrules =1.1.3, =1.1.3, =1.0.0, =0.2.1,...

maven:3.6 security and enhancement update

An update is available for apache-commons-io, atinject, jsr-305, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, guava, apache-commons-cli, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, apache-commons-lang3, plexus-interpolation, sisu,...

[SECURITY] Fedora 34 Update: maven-shared-utils-3.2.1-0.9.fc34

This project aims to be a functional replacement for plexus-utils in Maven. It is not a 100% API compatible replacement though but a replacement with improvements: lots of methods got cleaned up, generics got added and we dropp ed a lot of unused code...

Plexus-utils Arbitrary Command Execution

The vulnerability of the Plexus-utils package of the IBM Netezza Analytics extended analytics platform exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrar...

3.6 bug fix and enhancement update

An update is available for apache-commons-io, atinject, jsr-305, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, guava, apache-commons-cli, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, apache-commons-lang3, plexus-interpolation, sisu,...

JFrog < 7.11.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.11.1. It is, therefore, affected by multiple vulnerabilities: - A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Plexus-utils (CVE-2017-1000487)

Summary Plexus-utils could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input. By sending contents with double quoted strings, an attacker could exploit this vulnerability to execute arbitrary commands on the system...

Debian DSA-4146-1 : plexus-utils - security update

Charles Duffy discovered that the Commandline class in the utilities for the Plexus framework performs insufficient quoting of double-encoded strings, which could result in the execution of arbitrary shell commands. C Tenable Network Security, Inc. The descriptive text and package checks in this...

[SECURITY] [DSA 4146-1] plexus-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4146-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 20, 2018 https://www.debian.org/security/faq -...

DSA-4146-1 plexus-utils - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4146-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...