io.inkstand:scribble-http (>=0.3.0, <=0.3.2.1), io.mangoo:mangooio-core (>=2.0.0-beta6, <=2.0.0-beta7) +8 more potentially affected by CVE-2020-10719 via io.undertow:undertow-core (1.3.6.final)

io.undertow:undertow-core MAVEN version 1.3.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.inkstand:scribble-http =0.3.0, =2.0.0-beta6, =2.0.0-beta6, =2.0.0-beta6, =2.0.0-beta6, =0.4.0-m1,...

Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin

Impact Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This...

Insecure Temporary File

org.openapitools, openapi-generator-maven-plugin uses insecure temporary file. The vulnerability exists due to the usage of the function File.createTempFile which allows an attacker can predict the name of the temporary file and potentially gain access to confidential information...

CVE-2021-21429

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to...

Design/Logic Flaw

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to...

CVE-2021-21429 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to...

OpenAPI Generator 安全漏洞

OpenAPI Tools OpenAPI Generator is an OpenAPI generator. The product allows automatic generation of API client libraries SDK generation, server stubs, documentation, configuration, etc. given the OpenAPI specification v2, v3. A security vulnerability exists in OpenAPI Generator v5.1.0, which stem...

org.smartboot.flow:smart-flow-admin (>=1.0.8, <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9, <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9, <=0.6)

org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: GHSA-GWRP-PVRQ-JMWV...

org.smartboot.flow:smart-flow-admin (>=1.0.8, <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9, <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9, <=0.6)

org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: OSV:GHSA-GWRP-PVRQ-JMWV...

ch.sourcepond.maven.plugins:maven-plugin (>=0.2.0, <=0.4.13), ch.sourcepond.maven.plugins:repository-builder (>=0.0.1, <=0.0.2) +140 more potentially affected by CVE-2020-8908 via com.google.guava:guava (19.0-rc2)

com.google.guava:guava MAVEN version 19.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ch.sourcepond.maven.plugins:maven-plugin =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.2.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0,...

ai.databand.azkaban:azkaban-common (3.18.0), ai.databand.azkaban:azkaban-exec-server (3.18.0) +2457 more potentially affected by CVE-2020-8908 via com.google.guava:guava (13.0.1)

com.google.guava:guava MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.databand.azkaban:azkaban-common 3.18.0 - ai.databand.azkaban:azkaban-exec-server 3.18.0 -...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1326 more potentially affected by CVE-2020-13959 via org.apache.velocity:velocity-tools (>=2.0-beta3, <=2.0)

org.apache.velocity:velocity-tools MAVEN version =2.0-beta3, =9.1.1, =1.0.0-alpha-2, =1.0.0, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.1.0 and more Source cves: CVE-2020-13959 Source advisory: OSV:GHSA-FH63-4R66-JC7V...

Unauthorised Modification

pgpverify-maven-plugin allows unauthorized modification. An attacker is able to push base repository or access secrets by checking out and running build script from a fork the untrusted code is running in an environment...

com.alexkasko.krakatau:krakatau-maven-plugin-test (>=1.0, <=1.1), com.alexkasko.netty:netty-ftp-receiver (>=1.0, <=1.2.3) +4 more potentially affected by CVE-2021-21290 +1 more via org.jboss.netty:netty (3.2.8.final)

org.jboss.netty:netty MAVEN version 3.2.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.netty:netty and may be impacted: - com.alexkasko.krakatau:krakatau-maven-plugin-test =1.0, =1.0, =0.12.1, =1.0.0, =1.0.3 - com.emc.ecs:nfsclient...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

Deserialization of untrusted data

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

CVE-2020-10721

CVE-2020-10721 affects the fabric8-maven-plugin (4.0.0 and later). The vulnerability arises when using a wildfly-swarm or thorntail custom configuration, where a malicious YAML file on the machine running the Maven plugin can trigger deserialization of untrusted data, enabling arbitrary code exec...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...