io.brooklyn.clocker:brooklyn-clocker-dist (>=1.1.0, <=1.1.1), io.brooklyn.clocker:brooklyn-clocker-jsgui (>=1.1.0, <=1.1.1) +1 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-jsgui (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-jsgui MAVEN version =0.7.0-incubating, =1.1.0, =1.1.0, =0.7.0-incubating, =0.9.0 Source cves: CVE-2016-8737 Source advisory: OSV:GHSA-G2HF-G7FH-VG92...

io.brooklyn.clocker:brooklyn-clocker-dist (>=1.1.0, <=1.1.1), io.brooklyn.clocker:brooklyn-clocker-jsgui (>=1.1.0, <=1.1.1) +1 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-jsgui (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-jsgui MAVEN version =0.7.0-incubating, =1.1.0, =1.1.0, =0.7.0-incubating, =0.9.0 Source cves: CVE-2016-8737 Source advisory: GHSA-G2HF-G7FH-VG92...

io.brooklyn.clocker:brooklyn-clocker-dist (>=1.1.0, <=1.1.1), io.brooklyn.clocker:brooklyn-clocker-jsgui (>=1.1.0, <=1.1.1) +1 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-jsgui (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-jsgui MAVEN version =0.7.0-incubating, =1.1.0, =1.1.0, =0.7.0-incubating, =0.9.0 Source cves: CVE-2016-8737 Source advisory: SNYK:JAVA-ORGAPACHEBROOKLYN-9962104...

Cross-site Request Forgery (CSRF)

Overview org.apache.brooklyn:brooklyn-jsgui is a software for managing cloud applications. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the...

io.brooklyn.clocker:brooklyn-clocker-dist (>=1.1.0, <=1.1.1), io.brooklyn.clocker:brooklyn-clocker-jsgui (>=1.1.0, <=1.1.1) +1 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-jsgui (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-jsgui MAVEN version =0.7.0-incubating, =1.1.0, =1.1.0, =0.7.0-incubating, =0.9.0 Source cves: CVE-2016-8737 Source advisory: MEND:CVE-2016-8737...

Cross-Site Scripting (XSS)

brooklyn-jsgui is vulnerable to cross-site scripting XSS attacks. A malicious user can deploy an entity with the alert html tags in its name, allowing the execution of arbitrary code...