XML External Entity (XXE)

javamelody-core is vulnerable to XML external entity attacks. This is due to enabled support for external entities and DTD in parseSoapMethodName function in bull/javamelody/PayloadNameRequestWrapper.java which allows for a remote attacker to perform such attacks...

Cross-site Scripting (XSS)

javamelody-core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization in the counter parameter when performing the clearcounter action through the /monitoring URI, causing XSS attacks...