ca.uhn.hapi.fhir:hapi-fhir-cli-api (=5.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (=5.1.0) +152 more potentially affected by CVE-2020-5411 via org.springframework.batch:spring-batch-core (>=4.0.0.RELEASE <=4.2.2.RELEASE)

org.springframework.batch:spring-batch-core MAVEN version =4.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =4.2.0, =4.2.0, =3.0.0, =2020.08.001 and more Source cves: CVE-2020-5411 Source advisory: OSV:GHSA-4PH4-Q9R5-6WM6...

cloud.altemista.fwk.batch:cloud-altemistafwk-core-batch-spring (>=3.0.0.RELEASE <=3.0.1.RELEASE), cloud.altemista.fwk.batch:cloud-altemistafwk-core-batch-spring-conf (>=3.0.0.RELEASE <=3.0.1.RELEASE) +46 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (>=4.0.0.RELEASE <=4.0.1.RELEASE)

org.springframework.batch:spring-batch-core MAVEN version =4.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0, =1.0.0, =1.0.1, =1.0.0, =1.0.1, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.1.RELEASE and more Source cves: CVE-2019-3774 Source advisory: OSV:G...

be.dnsbelgium:rdap-server (>=0.3.3 <=1.1.0), com.bazoud.metrics:metrics-spring-batch (=1.0) +135 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (>=1.0.0.FINAL <=3.0.0.RELEASE)

org.springframework.batch:spring-batch-core MAVEN version =1.0.0.FINAL, =0.3.3, =0.0.4, =0.2.4, =0.1.0, =1.0.2, =1.0.2, =0.3.1, =0.2.0, =0.2.3 and more Source cves: CVE-2019-3774 Source advisory: OSV:GHSA-3WC8-659G-R88Q...

com.github.chrisgleissner:spring-batch-rest-api (>=1.0.3 <=1.2.7), com.github.chrisgleissner:spring-batch-rest-example (>=1.0.3 <=1.2.7) +7 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (=4.1.0.RELEASE)

org.springframework.batch:spring-batch-core MAVEN version =4.1.0.RELEASE is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.batch:spring-batch-core and may be impacted: - com.github.chrisgleissner:spring-batch-rest-api =1.0.3, =1.0.3,...

XML External Entity Injection (XXE)

Spring Batch Core is vulnerable to XML external entity injection XXE. The vulnerability exists because it fails to disable Document Type Definition External Entities by default, allowing an attacker to perform XXE attacks using malicious XML data input...