GHSA-4X6G-3CMX-W76R Snyk plugins vulnerable to Command Injection

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

PT-2022-15754 · Snyk · Snyk-Python-Plugin +7

Name of the Vulnerable Software and Affected Versions: snyk versions prior to 1.1064.0 snyk-mvn-plugin versions prior to 2.31.3 snyk-gradle-plugin versions prior to 3.24.5 @snyk/snyk-cocoapods-plugin versions prior to 2.5.3 snyk-sbt-plugin versions prior to 2.16.2 snyk-python-plugin versions prio...

Command Injection

Overview snyk-mvn-plugin is a plugin for the Snyk CLI tool, providing dependency metadata for Maven projects that use mvn and have a pom.xml file. Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attacke...

@adobe/helix-cli (>=0.10.6 <=1.0.0), @bifravst/code-style (>=8.0.36 <=8.0.133) +41 more potentially affected by CVE-2022-22984 +1 more via snyk-mvn-plugin (>=2.0.0 <=2.31.2)

snyk-mvn-plugin NPM version =2.0.0, =0.10.6, =8.0.36, =5.0.22, =3.10.42, =0.5.8, =3.2.4, =0.0.21, =2.6.1, =2.6.1, =5.0.0, =3.0.3-beta.1, =1.0.7, =0.1.1, =0.1.5 and more Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory: SNYK:JS-SNYKMVNPLUGIN-3038623...

CVE-2022-34190

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure...

GHSA-W7GJ-H6F2-X4C6 fabric8-maven-plugin: insecure way to construct Yaml Object leading to remote code execution

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

fabric8-maven-plugin: insecure way to construct Yaml Object leading to remote code execution

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

com.barchart.jenkins:maven-release-cascade (>=1.0.0 <=1.3.2), com.groupon.jenkins.plugins:DotCi-Plugins-Starter-Pack (>=1.0.0 <=1.6.2) +120 more potentially affected by CVE-2019-10358 via org.jenkins-ci.main:maven-plugin (>=1.396 <=3.1)

org.jenkins-ci.main:maven-plugin MAVEN version =1.396, =1.0.0, =1.0.0, =1.0.0, =1.0b, =0.9, =0.4.0, =1.2, =1.0.0, =1.7, =0.9, =0.1, =0.33, =1.396, =1.644 and more Source cves: CVE-2019-10358 Source advisory: OSV:GHSA-HR96-QFVM-52R6...

br.com.ingenieux:jbake-maven-plugin (>=0.0.3 <=0.0.9), br.com.jarch:jarch-apt (>=20.3.0 <=25.12.0) +450 more potentially affected by CVE-2016-10750 via com.hazelcast:hazelcast (>=1.7 <=3.10.7)

com.hazelcast:hazelcast MAVEN version =1.7, =0.0.3, =20.3.0, =24.2.0, =20.3.0, =2.23.5, =2.23.5, =23.1.0, =2.23.0, =2.23.5, =2.23.5, =2.23.5, =1.0.0, =1.0.0-final, =1.1.0-final and more Source cves: CVE-2016-10750 Source advisory: OSV:GHSA-JV65-PF7V-F7P8...

com.antelink.reporter.jenkins.plugin:AntepediaReporter-CI-plugin (>=1.7 <=1.8), com.dubture.jenkins:digitalocean-plugin (>=0.1 <=0.2) +39 more potentially affected by CVE-2014-2058 via org.jenkins-ci.main:jenkins-core (>=1.533 <=1.550)

org.jenkins-ci.main:jenkins-core MAVEN version =1.533, =1.7, =0.1, =1.53, =1.0.0, =0.1, =1.533, =1.533, =1.533, =1.533, =0.1.3, =0.1.5 and more Source cves: CVE-2014-2058 Source advisory: OSV:GHSA-7FPG-PP3M-H22F...

com.antelink.reporter.jenkins.plugin:AntepediaReporter-CI-plugin (>=1.7 <=1.8), com.dubture.jenkins:digitalocean-plugin (>=0.1 <=0.2) +39 more potentially affected by CVE-2014-2066 via org.jenkins-ci.main:jenkins-core (>=1.533 <=1.550)

org.jenkins-ci.main:jenkins-core MAVEN version =1.533, =1.7, =0.1, =1.53, =1.0.0, =0.1, =1.533, =1.533, =1.533, =1.533, =0.1.3, =0.1.5 and more Source cves: CVE-2014-2066 Source advisory: OSV:GHSA-8JFX-H6Q2-V4G3...

hudson.plugins.concurrent_login:concurrent-login-plugin (>=0.5 <=0.7), org.jenkins-ci.main:jenkins-test-harness (=1.513) +4 more potentially affected by CVE-2013-2034 via org.jenkins-ci.main:jenkins-core (=1.513)

org.jenkins-ci.main:jenkins-core MAVEN version =1.513 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - hudson.plugins.concurrentlogin:concurrent-login-plugin =0.5, =0.7 -...

net.adamcin.recap:net.adamcin.recap.addressbook (>=0.8.0 <=1.0.1), net.adamcin.recap:net.adamcin.recap.core (>=0.8.0 <=1.0.1) +16 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.4.0 <=2.4.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.4.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.1.0, =2.1.2, =5.12.0, =5.11.0, =5.12.2 and more Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

au.com.permeance:liferay-clojure-integration (=0.1), com.liferay.maven.plugins:liferay-maven-plugin (>=6.0.2 <=6.0.6) +6 more potentially affected by CVE-2010-5327 via com.liferay.portal:portal-impl (>=5.2.3 <=6.2.1)

com.liferay.portal:portal-impl MAVEN version =5.2.3, =6.0.2, =6.1.2, =5.2.3, =2.4, =1.0, =2.0, =2.5 Source cves: CVE-2010-5327 Source advisory: OSV:GHSA-97GM-MCV6-CPHM...

com.barchart.jenkins:maven-release-cascade (>=1.0.0 <=1.3.2), com.groupon.jenkins.plugins:DotCi-Plugins-Starter-Pack (>=1.0.0 <=1.6.2) +119 more potentially affected by CVE-2017-1000397 via org.jenkins-ci.main:maven-plugin (>=1.396 <=2.9)

org.jenkins-ci.main:maven-plugin MAVEN version =1.396, =1.0.0, =1.0.0, =1.0.0, =1.0b, =0.9, =0.4.0, =1.2, =1.0.0, =1.7, =0.9, =0.1, =0.33, =1.396, =1.644 and more Source cves: CVE-2017-1000397 Source advisory: OSV:GHSA-QHXW-54M9-6WWC...

com.day.crx:crx-auth-ldap (=2.3.15), com.day.crx:crx-spellchecker (>=2.3.14 <=2.3.64) +14 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.4.0 <=2.4.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.4.0, =2.3.14, =2.3.14, =0.6.0, =2.4.0, =2.4.0, =2.4.0, =5.12.0, =5.11.0, =5.11.0, =5.11.0, =5.12.2 and more Source cves: CVE-2015-1833 Source advisory: OSV:GHSA-9284-J4C9-779Q...

com.artnaseef:activemq-maven-plugin (=5.10.0), com.github.cchacin:cucumber-common-steps (>=0.0.2 <=0.1.8) +174 more potentially affected by CVE-2014-3600 via org.apache.activemq:activemq-client (=5.10.0)

org.apache.activemq:activemq-client MAVEN version =5.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-client and may be impacted: - com.artnaseef:activemq-maven-plugin =5.10.0 - com.github.cchacin:cucumber-common-steps...

com.cognifide.aet:aet-maven-plugin (>=2.0.0 <=2.1.6), com.cognifide.aet:cleaner (>=2.0.0 <=2.1.6) +159 more potentially affected by CVE-2016-0782 via org.apache.activemq:activemq-client (>=5.13.0 <=5.13.1)

org.apache.activemq:activemq-client MAVEN version =5.13.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.3-rc1, =2.0.0, =1.6, =1.6, =1.6, =1.0.0, =2015.12.20, =2015.12.20, =2015.12.20, =2016.2.7 and more Source cves: CVE-2016-0782 Source advisory: OSV:GHSA-8RCQ-P4GH-VMJ8...

com.github.kulya:jmeter-gradle-plugin (>=1.3.1-2.6 <=1.3.4-2.9), com.lazerycode.jmeter:jmeter-maven-plugin (>=1.4 <=1.8.1) +4 more potentially affected by CVE-2018-1297 via org.apache.jmeter:ApacheJMeter (>=2.6 <=3.3)

org.apache.jmeter:ApacheJMeter MAVEN version =2.6, =1.3.1-2.6, =1.4, =1.0.7-3.0-BETA, =1.0.7-3.0-BETA, =6.3.0, =6.2.0, =6.6.0 Source cves: CVE-2018-1297 Source advisory: OSV:GHSA-7V85-6HV2-RWGW...

com.github.kulya:jmeter-gradle-plugin (>=1.3.1-2.6 <=1.3.4-2.9), com.lazerycode.jmeter:jmeter-maven-plugin (>=1.4 <=1.8.1) +4 more potentially affected by CVE-2018-1287 via org.apache.jmeter:ApacheJMeter (>=2.6 <=3.3)

org.apache.jmeter:ApacheJMeter MAVEN version =2.6, =1.3.1-2.6, =1.4, =1.0.7-3.0-BETA, =1.0.7-3.0-BETA, =6.3.0, =6.2.0, =6.6.0 Source cves: CVE-2018-1287 Source advisory: OSV:GHSA-J7J7-G4WW-PXG5...