XML External Entity (XXE)

liquibase-core is vulnerable to XML external entity attacks. The XMLChangeLogSAXParser function of XMLChangeLogSAXParser.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...

ch.inftec.ju:ju-dbutil-test (4.1), com.aceevo.ursus:ursus-db (>=0.2.11, <=0.2.15) +11 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.0.7)

org.liquibase:liquibase-core MAVEN version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - ch.inftec.ju:ju-dbutil-test 4.1 - com.aceevo.ursus:ursus-db =0.2.11, =2.3, =1.0.0, =1.0.0, =1.0.0,...

org.infrastructurebuilder.data:ibdata-avrotosql (0.3.4), org.infrastructurebuilder.data:ibdata-database-dialect-base (0.3.4) +11 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.3)

org.liquibase:liquibase-core MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.infrastructurebuilder.data:ibdata-avrotosql 0.3.4 -...

com.atlassian.connect:atlassian-connect-spring-boot-jpa-starter (2.0.4), com.hack23.cia:service.data.impl (2020.1.14) +35 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.5)

org.liquibase:liquibase-core MAVEN version 3.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-jpa-starter 2.0.4 - com.hack23.cia:service.data.imp...

ch.ayedo.jooqmodelator:ch.ayedo.jooqmodelator.gradle.plugin (>=3.7.0, <=3.9.0), com.fortitudetec:elucidation-bundle (4.1.1) +28 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.10.0)

org.liquibase:liquibase-core MAVEN version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - ch.ayedo.jooqmodelator:ch.ayedo.jooqmodelator.gradle.plugin =3.7.0, =3.7.0, =2.0.11, =1.6.0.cr1,...

cn.ibizlab.plugin:ibiz-plugin-centralstudio-core (>=8.1.0.286, <=8.1.0.567.22), cn.ibizlab.plugin:ibiz-plugin-centralstudio-freemarker (>=8.1.0.286, <=8.1.0.567.22) +86 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.10.3)

org.liquibase:liquibase-core MAVEN version 3.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - cn.ibizlab.plugin:ibiz-plugin-centralstudio-core =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286,...

com.github.evantill:liquibase-utils (>=0.0.3, <=0.2.0), com.konnectkode:quarkus-liquibase (1.0.0.cr2) +16 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.1)

org.liquibase:liquibase-core MAVEN version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.github.evantill:liquibase-utils =0.0.3, =3.5.30, =3.5.30, =3.10.15, =3.5.30, =3.5.30, =3.5.30,...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=2.1.8, <=2.1.9), com.github.jamesnetherton:wildfly-liquibase-distro (0.7.0) +26 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.2)

org.liquibase:liquibase-core MAVEN version 3.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example =2.1.8, =1.0.0, =4.2.9, =4.2....

com.hack23.cia:service.data.impl (2019.12.21), com.hack23.cia:service.impl (2019.12.21) +13 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.4)

org.liquibase:liquibase-core MAVEN version 3.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.hack23.cia:service.data.impl 2019.12.21 - com.hack23.cia:service.impl 2019.12.21 -...

be.yildiz-games:module-database-updater (1.0.0), com.github.vzakharchenko:dynamic-orm-core (>=1.1.1, <=1.2.2) +50 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.7)

org.liquibase:liquibase-core MAVEN version 3.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - be.yildiz-games:module-database-updater 1.0.0 - com.github.vzakharchenko:dynamic-orm-core =1.1.1, =1.1....

be.yildiz-games:module-database-updater (1.0.3), com.github.adangel.liquibase.ext:liquibase-percona (1.7.0) +36 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.10.1)

org.liquibase:liquibase-core MAVEN version 3.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - be.yildiz-games:module-database-updater 1.0.3 - com.github.adangel.liquibase.ext:liquibase-percona 1.7...

de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.basic (>=1.13.0, <=1.14.0), de.fraunhofer.iosb.ilt.frost-server:frost-server.http (>=1.13.0, <=1.14.0) +14 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.10.2)

org.liquibase:liquibase-core MAVEN version 3.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.basic =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13....

africa.absa:inception-application (>=1.0.0, <=1.2.0), africa.absa:inception-test (>=1.0.0, <=1.2.0) +507 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (>=4.0.0-beta1, <=4.7.1)

org.liquibase:liquibase-core MAVEN version =4.0.0-beta1, =1.0.0, =1.0.0, =2.0.1, =1.0.4, =1.0, =1.3.29.8, =1.3.30, =1.0.35, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.2.4, =2.0.1, =2.2.8 and more Source cves: CVE-2022-0839 Source advisory: GHSA-JVFV-HRRC-6Q72...

org.liquibase:liquibase-plugin (1.9.4.0) potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (1.9.4)

org.liquibase:liquibase-core MAVEN version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.liquibase:liquibase-plugin 1.9.4.0 Source cves: CVE-2022-0839 Source advisory: OSV:GHSA-JVFV-HRRC-6...

org.liquibase:liquibase-plugin (1.3.3.0) potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (1.3.3)

org.liquibase:liquibase-core MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.liquibase:liquibase-plugin 1.3.3.0 Source cves: CVE-2022-0839 Source advisory: OSV:GHSA-JVFV-HRRC-6...

org.liquibase:liquibase-plugin (1.8.1.0) potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (1.8.1)

org.liquibase:liquibase-core MAVEN version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.liquibase:liquibase-plugin 1.8.1.0 Source cves: CVE-2022-0839 Source advisory: OSV:GHSA-JVFV-HRRC-6...

org.liquibase.ext:liquibase-hibernate (2.0.0), org.liquibase.ext:liquibase-mssql (1.2.0) +4 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (2.0.0)

org.liquibase:liquibase-core MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.liquibase.ext:liquibase-hibernate 2.0.0 - org.liquibase.ext:liquibase-mssql 1.2.0 -...

org.kualigan.liquibase:kualigan-lb-ant (1.0.0), org.kualigan.liquibase:kualigan-lb-extensions (1.0.0) +2 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (2.0.2)

org.liquibase:liquibase-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.kualigan.liquibase:kualigan-lb-ant 1.0.0 - org.kualigan.liquibase:kualigan-lb-extensions 1.0.0 -...

org.liquibase:liquibase-maven-plugin (2.0.4), org.liquibase:liquibase-osgi (2.0.4) potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (2.0.4)

org.liquibase:liquibase-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.liquibase:liquibase-maven-plugin 2.0.4 - org.liquibase:liquibase-osgi 2.0.4 Source cves:...

com.mattbertolini:liquibase-slf4j (1.1.0), org.liquibase:liquibase-maven-plugin (3.0.2) +1 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.0.2)

org.liquibase:liquibase-core MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.mattbertolini:liquibase-slf4j 1.1.0 - org.liquibase:liquibase-maven-plugin 3.0.2 -...