com.github.albfernandez:jbpm (>=3.2.10-1-sp3_seam2_hibernate5, <=3.2.11.ayg), com.github.albfernandez:jbpm-enterprise (>=3.2.10-1-sp3_seam2_hibernate5, <=3.2.11.ayg) +6 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.6.2)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - com.github.albfernandez:jbpm =3.2.10-1-sp3seam2hibernate5,...

biz.netcentric.cq.tools.accesscontroltool:sling-minimum-version-environment (>=4.2.0, <=4.2.4), com.adobe.cq.testing:cq-it-framework (2.0.130) +25 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.2.0, <=2.2.13)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.2.0, =4.2.0, =2.2.0, =1.0.0, =0.2.0, =0.2.0, =2.9.0, =2.2.0, =2.2.0, =2.2.13 - org.apache.james:apache-james 3.0-beta3 and more Source cves: CVE-2015-1833 Source advisory: OSV:GHSA-9284-J4C9-779Q...

org.apache.camel:camel-jcr (>=1.3.0, <=1.4.0), org.apache.jackrabbit:jackrabbit-jca (1.3.3) +4 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (1.3.3)

org.apache.jackrabbit:jackrabbit-core MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - org.apache.camel:camel-jcr =1.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.3 Source cves:...

org.opencms:opencms-webapp (8.0.4) potentially affected by CVE-2015-2351 via org.opencms:opencms-core (8.0.4)

org.opencms:opencms-core MAVEN version 8.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-webapp 8.0.4 Source cves: CVE-2015-2351 Source advisory: OSV:GHSA-6C8C-F2W2-JVJR...

org.opencms:opencms-webapp (8.0.2) potentially affected by CVE-2015-2351 via org.opencms:opencms-core (8.0.2)

org.opencms:opencms-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-webapp 8.0.2 Source cves: CVE-2015-2351 Source advisory: OSV:GHSA-6C8C-F2W2-JVJR...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via multiple parameters such as setName, webappType, httpPort, dsName, description, phase, and url in different JSP pages. An attacker can inject arbitrary web script or HTML by sending crafted input to these...

org.apache.tomee:arquillian-tomee-jaxrs-tests (>=7.0.0-m1, <=7.0.4), org.apache.tomee:tomee-plume-webapp (>=7.0.0-m1, <=7.0.4) +1 more potentially affected by CVE-2018-8031 via org.apache.tomee:tomee-webapp (>=7.0.0-m1, <=7.0.4)

org.apache.tomee:tomee-webapp MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.4 Source cves: CVE-2018-8031 Source advisory: OSV:GHSA-FG44-W3FR-HGXV...

org.apache.tomee:arquillian-tomee-jaxrs-tests (>=7.0.0-m1, <=7.0.4), org.apache.tomee:tomee-plume-webapp (>=7.0.0-m1, <=7.0.4) +1 more potentially affected by CVE-2018-8031 via org.apache.tomee:tomee-webapp (>=7.0.0-m1, <=7.0.4)

org.apache.tomee:tomee-webapp MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.4 Source cves: CVE-2018-8031 Source advisory: GHSA-FG44-W3FR-HGXV...

org.eclipse.jetty.aggregate:jetty-all (7.5.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.5.0.rc0) +43 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.5.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.5.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.6.18.v20150929), org.eclipse.jetty.aggregate:jetty-all-server (7.6.18.v20150929) +37 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.18.v20150929)

org.eclipse.jetty:jetty-server MAVEN version 7.6.18.v20150929 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.18.v20150929 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.6.v20120903), org.eclipse.jetty.aggregate:jetty-all-server (7.6.6.v20120903) +51 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.6.v20120903)

org.eclipse.jetty:jetty-server MAVEN version 7.6.6.v20120903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.6.v20120903 -...

org.cometd.java:cometd-examples-java (1.0.0rc0), org.cometd.java:cometd-java-oort (1.0.0rc0) +33 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.0.rc4)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-examples-java 1.0.0rc0 - org.cometd.java:cometd-java-oort 1.0.0rc0 -...

org.eclipse.jetty.aggregate:jetty-all (7.4.1.v20110513), org.eclipse.jetty.aggregate:jetty-all-server (7.4.1.v20110513) +56 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.4.1.v20110513)

org.eclipse.jetty:jetty-server MAVEN version 7.4.1.v20110513 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.4.1.v20110513 -...

org.eclipse.jetty.aggregate:jetty-all (7.0.2.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.2.rc0) +37 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.2.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.2.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.2.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.6.20.v20160902), org.eclipse.jetty.aggregate:jetty-all-server (7.6.20.v20160902) +36 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.20.v20160902)

org.eclipse.jetty:jetty-server MAVEN version 7.6.20.v20160902 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.20.v20160902 -...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc5), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc5) +30 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc5 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +32 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.0.rc6)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.5.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.5.0.rc1) +43 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.5.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.5.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.apache.felix:org.apache.felix.http.bundle (2.2.2), org.apache.felix:org.apache.felix.http.jetty (2.2.2) +52 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.13.v20130916)

org.eclipse.jetty:jetty-server MAVEN version 7.6.13.v20130916 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.felix:org.apache.felix.http.bundle 2.2.2 -...

GHSA-PRC3-7F44-W48J Missing XML Validation in Apache Tomcat

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to 1 read arbitrary files via a crafted web application that provides an XML external entity...