EUVD-2022-3901

Malicious code in bioql PyPI...

EUVD-2022-4676

Malicious code in bioql PyPI...

CVE-2013-4378

Cross-site scripting XSS vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header...

Java Melody vulnerable to cross-site scripting

JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting XSS attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds...

GHSA-CQHR-JQVC-QW9P Java Melody vulnerable to cross-site scripting

JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting XSS attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds...

cc.catalysts.boot:cat-boot-javamelody (>=0.0.4 <=0.2.28), net.bull.javamelody:javamelody-collector-server (>=1.57.0 <=1.60.0) +1 more potentially affected by CVE-2016-1000273 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.60.0)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =0.0.4, =1.57.0, =1.10.0, =1.60.0 Source cves: CVE-2016-1000273 Source advisory: OSV:GHSA-CQHR-JQVC-QW9P...

org.jvnet.hudson.plugins:monitoring (>=1.10.0 <=1.46.0) potentially affected by CVE-2013-4378 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.46.0)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =1.10.0, =1.46.0 Source cves: CVE-2013-4378 Source advisory: OSV:GHSA-P4MX-P49M-8RW4...

GHSA-P4MX-P49M-8RW4 Improper Neutralization of Input During Web Page Generation in JavaMelody

Cross-site scripting XSS vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header...

Improper Neutralization of Input During Web Page Generation in JavaMelody

Cross-site scripting XSS vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header...

GHSA-G66Q-GRXC-64J3 Cross-site Scripting in JavaMelody

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

Cross-site Scripting in JavaMelody

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

cc.catalysts.boot:cat-boot-javamelody (>=0.0.4 <=0.2.28), net.bull.javamelody:javamelody-collector-server (>=1.57.0 <=1.60.0) +1 more potentially affected by CVE-2018-12432 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.60.0)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =0.0.4, =1.57.0, =1.10.0, =1.60.0 Source cves: CVE-2018-12432 Source advisory: OSV:GHSA-G66Q-GRXC-64J3...

br.com.thiaguten:umbrella-monitoring (>=0.1.0 <=0.1.1), cc.catalysts.boot:cat-boot-javamelody (>=0.0.4 <=0.2.28) +7 more potentially affected by CVE-2018-15531 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.73.1)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =0.1.0, =0.0.4, =1.57.0, =1.64.0, =1.5.7.0, =1.10.0, =2.0.0, =2.0.0, =2.0.1 - uk.ac.ebi.interpro.scan:server =5.36-75.0 Source cves: CVE-2018-15531 Source advisory: OSV:GHSA-6FVX-R7HX-3VH6...

GHSA-6FVX-R7HX-3VH6 JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

XML External Entity (XXE)

javamelody-core is vulnerable to XML external entity attacks. This is due to enabled support for external entities and DTD in parseSoapMethodName function in bull/javamelody/PayloadNameRequestWrapper.java which allows for a remote attacker to perform such attacks...

Code injection

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

CVE-2018-15531

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

CVE-2018-15531

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

CVE-2018-15531

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...