at.molindo:esi4j (>=0.3.0-alpha-1, <=3.0.2), at.molindo:scrutineer (>=2.0.0, <=3.0.0) +9 more potentially affected by CVE-2022-24913 via com.fasterxml.util:java-merge-sort (>=0.7.1, <=1.0.2)

com.fasterxml.util:java-merge-sort MAVEN version =0.7.1, =0.3.0-alpha-1, =2.0.0, =1.0.3, =2.3.0, =0.5.3, =0.5.3, =0.9.0, =0.5.3, =0.5.3, =0.9.0, =1.0.2, =1.0.4 Source cves: CVE-2022-24913 Source advisory: MEND:CVE-2022-24913...

CVE-2022-24913: Insecure Temporary File

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider function in StdTempFileProvider.java, which uses the permissive File.createTempFile function, exposing temporary file contents...