EUVD-2022-3901

Malicious code in bioql PyPI...

EUVD-2022-4676

Malicious code in bioql PyPI...

CVE-2013-4378

Cross-site scripting XSS vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header...

GHSA-CQHR-JQVC-QW9P Java Melody vulnerable to cross-site scripting

JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting XSS attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds...

Java Melody vulnerable to cross-site scripting

JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting XSS attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds...

cc.catalysts.boot:cat-boot-javamelody (>=0.0.4 <=0.2.28), net.bull.javamelody:javamelody-collector-server (>=1.57.0 <=1.60.0) +1 more potentially affected by CVE-2016-1000273 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.60.0)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =0.0.4, =1.57.0, =1.10.0, =1.60.0 Source cves: CVE-2016-1000273 Source advisory: OSV:GHSA-CQHR-JQVC-QW9P...

org.jvnet.hudson.plugins:monitoring (>=1.10.0 <=1.46.0) potentially affected by CVE-2013-4378 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.46.0)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =1.10.0, =1.46.0 Source cves: CVE-2013-4378 Source advisory: OSV:GHSA-P4MX-P49M-8RW4...

GHSA-P4MX-P49M-8RW4 Improper Neutralization of Input During Web Page Generation in JavaMelody

Cross-site scripting XSS vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header...

Improper Neutralization of Input During Web Page Generation in JavaMelody

Cross-site scripting XSS vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header...

GHSA-G66Q-GRXC-64J3 Cross-site Scripting in JavaMelody

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

Cross-site Scripting in JavaMelody

JavaMelody through 1.60.0 has XSS via the counter parameter in a clearcounter action to the /monitoring URI...

cc.catalysts.boot:cat-boot-javamelody (>=0.0.4 <=0.2.28), net.bull.javamelody:javamelody-collector-server (>=1.57.0 <=1.60.0) +1 more potentially affected by CVE-2018-12432 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.60.0)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =0.0.4, =1.57.0, =1.10.0, =1.60.0 Source cves: CVE-2018-12432 Source advisory: OSV:GHSA-G66Q-GRXC-64J3...

br.com.thiaguten:umbrella-monitoring (>=0.1.0 <=0.1.1), cc.catalysts.boot:cat-boot-javamelody (>=0.0.4 <=0.2.28) +7 more potentially affected by CVE-2018-15531 via net.bull.javamelody:javamelody-core (>=1.10.0 <=1.73.1)

net.bull.javamelody:javamelody-core MAVEN version =1.10.0, =0.1.0, =0.0.4, =1.57.0, =1.64.0, =1.5.7.0, =1.10.0, =2.0.0, =2.0.0, =2.0.1 - uk.ac.ebi.interpro.scan:server =5.36-75.0 Source cves: CVE-2018-15531 Source advisory: OSV:GHSA-6FVX-R7HX-3VH6...

GHSA-6FVX-R7HX-3VH6 JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

XML External Entity (XXE)

javamelody-core is vulnerable to XML external entity attacks. This is due to enabled support for external entities and DTD in parseSoapMethodName function in bull/javamelody/PayloadNameRequestWrapper.java which allows for a remote attacker to perform such attacks...

Code injection

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

CVE-2018-15531

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

CVE-2018-15531

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...

CVE-2018-15531

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java...