io.github.htools:htools (>=0.26, <=0.27), io.github.k3nn:k3nn (0.01) +11 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-compat (2.2.1)

org.apache.maven:maven-compat MAVEN version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-compat and may be impacted: - io.github.htools:htools =0.26, =0.0.19, =0.0.19, =0.0.19, =0.0.15, =1.0-beta-5, =1.5, =1.16 Source...

com.jcabi:jcabi-aspects (0.7.14), com.jcabi:jcabi-heroku-maven-plugin (0.7.14) +2 more potentially affected by CVE-2020-10693 via org.hibernate:hibernate-validator (5.0.0.cr2)

org.hibernate:hibernate-validator MAVEN version 5.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.jcabi:jcabi-aspects 0.7.14 - com.jcabi:jcabi-heroku-maven-plugin 0.7.14 -...

com.jcabi:jcabi-aspects (0.7.8), com.jcabi:jcabi-heroku-maven-plugin (0.7.8) +4 more potentially affected by CVE-2020-10693 via org.hibernate:hibernate-validator (5.0.0.beta1)

org.hibernate:hibernate-validator MAVEN version 5.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.jcabi:jcabi-aspects 0.7.8 - com.jcabi:jcabi-heroku-maven-plugin 0.7.8 -...

rhel8 bug fix and enhancement update

An update is available for jmc, ee4j-parent, jaf, HdrHistogram, lz4-java, owasp-java-encoder, directory-maven-plugin, jmc-core. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

org.webjars:emberjs (1.2.0), ro.isdc.wro4j:wro4j-extensions (1.7.3) +1 more potentially affected by CVE-2021-23369 via org.webjars:handlebars (1.1.2)

org.webjars:handlebars MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:handlebars and may be impacted: - org.webjars:emberjs 1.2.0 - ro.isdc.wro4j:wro4j-extensions 1.7.3 - ro.isdc.wro4j:wro4j-maven-plugin 1.7.3 Source...

org.webjars:emberjs (>=1.0.0-rc.4, <=1.0.0-rc.6), ro.isdc.wro4j:wro4j-extensions (1.7.1) +1 more potentially affected by CVE-2021-23369 via org.webjars:handlebars (1.0.0-rc.4)

org.webjars:handlebars MAVEN version 1.0.0-rc.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:handlebars and may be impacted: - org.webjars:emberjs =1.0.0-rc.4, =1.0.0-rc.6 - ro.isdc.wro4j:wro4j-extensions 1.7.1 -...

io.undertow:undertow-servlet (1.0.14.final), io.undertow:undertow-websockets-jsr (1.0.14.final) +1 more potentially affected by CVE-2020-10719 via io.undertow:undertow-core (1.0.14.final)

io.undertow:undertow-core MAVEN version 1.0.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.14.final - io.undertow:undertow-websockets-jsr 1.0.14.final -...

io.inkstand:scribble-http (>=0.3.0, <=0.3.2.1), io.mangoo:mangooio-core (>=2.0.0-beta6, <=2.0.0-beta7) +8 more potentially affected by CVE-2020-10719 via io.undertow:undertow-core (1.3.6.final)

io.undertow:undertow-core MAVEN version 1.3.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.inkstand:scribble-http =0.3.0, =2.0.0-beta6, =2.0.0-beta6, =2.0.0-beta6, =2.0.0-beta6, =0.4.0-m1,...

Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin

Impact Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This...

Insecure Temporary File

org.openapitools, openapi-generator-maven-plugin uses insecure temporary file. The vulnerability exists due to the usage of the function File.createTempFile which allows an attacker can predict the name of the temporary file and potentially gain access to confidential information...

CVE-2021-21429

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to...

Design/Logic Flaw

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to...

CVE-2021-21429 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to...

OpenAPI Generator 安全漏洞

OpenAPI Tools OpenAPI Generator is an OpenAPI generator. The product allows automatic generation of API client libraries SDK generation, server stubs, documentation, configuration, etc. given the OpenAPI specification v2, v3. A security vulnerability exists in OpenAPI Generator v5.1.0, which stem...

org.smartboot.flow:smart-flow-admin (>=1.0.8, <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9, <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9, <=0.6)

org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: OSV:GHSA-GWRP-PVRQ-JMWV...

org.smartboot.flow:smart-flow-admin (>=1.0.8, <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9, <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9, <=0.6)

org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: GHSA-GWRP-PVRQ-JMWV...

ai.databand.azkaban:azkaban-common (3.18.0), ai.databand.azkaban:azkaban-exec-server (3.18.0) +2457 more potentially affected by CVE-2020-8908 via com.google.guava:guava (13.0.1)

com.google.guava:guava MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.databand.azkaban:azkaban-common 3.18.0 - ai.databand.azkaban:azkaban-exec-server 3.18.0 -...

ch.sourcepond.maven.plugins:maven-plugin (>=0.2.0, <=0.4.13), ch.sourcepond.maven.plugins:repository-builder (>=0.0.1, <=0.0.2) +140 more potentially affected by CVE-2020-8908 via com.google.guava:guava (19.0-rc2)

com.google.guava:guava MAVEN version 19.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ch.sourcepond.maven.plugins:maven-plugin =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.2.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0,...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1326 more potentially affected by CVE-2020-13959 via org.apache.velocity:velocity-tools (>=2.0-beta3, <=2.0)

org.apache.velocity:velocity-tools MAVEN version =2.0-beta3, =9.1.1, =1.0.0-alpha-2, =1.0.0, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.1.0 and more Source cves: CVE-2020-13959 Source advisory: OSV:GHSA-FH63-4R66-JC7V...

Unauthorised Modification

pgpverify-maven-plugin allows unauthorized modification. An attacker is able to push base repository or access secrets by checking out and running build script from a fork the untrusted code is running in an environment...