CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

CVE-2020-2234

A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkin...

ch.hortis.sonar:sonar-commons (0.2), ch.hortis.sonar:sonar-maven-plugin (0.2) potentially affected by CVE-2019-2692 via mysql:mysql-connector-java (5.0.2)

mysql:mysql-connector-java MAVEN version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - ch.hortis.sonar:sonar-commons 0.2 - ch.hortis.sonar:sonar-maven-plugin 0.2 Source cves: CVE-2019-2692 Sourc...

com.github.goldin:about-maven-plugin (>=0.2.4, <=0.2.5), com.github.goldin:assert-maven-plugin (>=0.2.4, <=0.2.5) +57 more potentially affected by CVE-2018-10237 via org.sonatype.sisu:sisu-guava (0.11.1)

org.sonatype.sisu:sisu-guava MAVEN version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonatype.sisu:sisu-guava and may be impacted: - com.github.goldin:about-maven-plugin =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4,...

com.github.goldin:about-maven-plugin (>=0.2.4, <=0.2.5), com.github.goldin:assert-maven-plugin (>=0.2.4, <=0.2.5) +57 more potentially affected by CVE-2018-10237 via org.sonatype.sisu:sisu-guava (0.11.1)

org.sonatype.sisu:sisu-guava MAVEN version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonatype.sisu:sisu-guava and may be impacted: - com.github.goldin:about-maven-plugin =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4,...

Unspecified Vulnerability in MojoHaus Exec Maven plugin for Maven

MojoHaus Exec Maven plugin for Maven is a use in Maven software project management and automated build tools to support the execution of Java programs in the plug-in . A security vulnerability exists in MojoHaus Exec Maven plugin for Maven version 1.1.1. The vulnerability can be exploited by an...

CVE-2019-20343

The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element within a plugin element can specify an arbitrary program in an executable element and can also specify arbitrary command-line arguments in an arguments element...

CVE-2019-20343

The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element within a plugin element can specify an arbitrary program in an executable element and can also specify arbitrary command-line arguments in an arguments element...

CVE-2019-20343: Improper Control of Generation of Code

The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element within a plugin element can specify an arbitrary program in an executable element and can also specify arbitrary command-line arguments in an arguments element...

PT-2020-10391

Name of the Vulnerable Software and Affected Versions The MojoHaus Exec Maven plugin version 1.1.1 Description The issue allows code execution via a crafted XML document. This is possible because a configuration element, within a plugin element, can specify an arbitrary program in an executable...

Improper Restriction of XML External Entity Reference in DiffPlug Spotless

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

CVE-2019-9843

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

Man-in-the-Middle (MitM)

Xtend Maven Plugin is vulnerable to man-in-the-middle MitM attack. The plugins are downloaded over an insecure HTTP channel, which would allow a man-in-the-middle attacker to modify and add malicious code into the plugins...

CVE-2019-9843: Improper Restriction of XML External Entity Reference

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

com.opower:opower-checks (1.0.0), com.qulice:qulice-ant (>=0.12.2, <=0.13.3) +2 more potentially affected by CVE-2019-9658 via com.puppycrawl.tools:checkstyle (6.8.1)

com.puppycrawl.tools:checkstyle MAVEN version 6.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.puppycrawl.tools:checkstyle and may be impacted: - com.opower:opower-checks 1.0.0 - com.qulice:qulice-ant =0.12.2, =0.12.2, =0.12.2, =0.13.3 Source...

com.rexsl:rexsl-maven-plugin (>=0.2, <=0.13.3), com.rexsl:rexsl-standalone (>=0.3.8, <=0.13.3) +43 more potentially affected by CVE-2017-7656 via org.eclipse.jetty:jetty-server (8.0.2.v20111006)

org.eclipse.jetty:jetty-server MAVEN version 8.0.2.v20111006 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.rexsl:rexsl-maven-plugin =0.2, =0.3.8, =0.13.3 - org.eclipse.jetty.aggregate:jetty-al...

com.rexsl:rexsl-maven-plugin (>=0.2, <=0.13.3), com.rexsl:rexsl-standalone (>=0.3.8, <=0.13.3) +43 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (8.0.2.v20111006)

org.eclipse.jetty:jetty-server MAVEN version 8.0.2.v20111006 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.rexsl:rexsl-maven-plugin =0.2, =0.3.8, =0.13.3 - org.eclipse.jetty.aggregate:jetty-al...

DependencyCheck v3.3.1 - A Software Composition Analysis Utility That Detects Publicly Disclosed Vulnerabilities In Application Dependencies

Dependency-Check is a Software Composition Analysis SCA tool that attempts to detect publicly disclosed vulnerabilities contained within a project's dependencies. It does this by determining if there is a Common Platform Enumeration CPE identifier for a given dependency. If found, it will generat...

OWASP DependencyCheck - A Software Composition Analysis Utility That Detects Publicly Disclosed Vulnerabilities In Application Dependencies

Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration CPE identifier for a given dependency. If found, it will generate a report linking to the associate...

CloudBees Jenkins Maven Plugin Man-in-the-Middle Attack Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Maven Plugin is one of the Maven framework plug-in . A security vulnerability...