XML External Entity (XXE)

liquibase-core is vulnerable to XML external entity attacks. The XMLChangeLogSAXParser function of XMLChangeLogSAXParser.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...

Cross-Site Scripting (XSS)

liquibase-core is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it employs the vulnerable version of jquery in liquibase-core/src/main/resources/liquibase/sdk/watch/js/jquery-1.11.0.min.js. This vulnerability is related to SID-6097...