com.github.vindell:spring-boot-starter-pf4j2 (>=1.0.0.release, <=1.0.1.release), org.pf4j:pf4j-update (>=2.0.0, <=2.1.0) potentially affected by CVE-2023-40827 via org.pf4j:pf4j (2.2.0)

org.pf4j:pf4j MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.github.vindell:spring-boot-starter-pf4j2 =1.0.0.release, =2.0.0, =2.1.0 Source cves: CVE-2023-40827 Source advisory:...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0-rc1, <=0.2.0-rc1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0-rc1, <=0.2.0-rc1) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.2.1-rc1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.2.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0-rc1, =0.1.0-rc1,...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.1, <=0.2.1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.1, <=0.2.1) +2 more potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.2.2-rc1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.2.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.1, =0.1.1, =1.1.2, =1.1....

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0, <=0.2.0), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.1.0-rc1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.1.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0, =0.1.0, =0.2.0 Source...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.3, <=0.2.3), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.3, <=0.2.3) +20 more potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.3)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.3, =0.1.3, =2.2.2-incubating...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.2, <=0.2.2), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.2, <=0.2.2) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.2, =0.1.2, =0.2.2 Source cve...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.4, <=0.2.4), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.4, <=0.2.4) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.4)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.4, =0.1.4, =0.2.4 Source cve...

com.linecorp.armeria:armeria-grpc (0.84.0), com.linecorp.armeria:armeria-grpc-protocol (0.84.0) +37 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.84.0)

com.linecorp.armeria:armeria MAVEN version 0.84.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.84.0 - com.linecorp.armeria:armeria-grpc-protocol 0.84.0 -...

com.linecorp.armeria:armeria-grpc (0.86.0), com.linecorp.armeria:armeria-grpc-protocol (0.86.0) +36 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.86.0)

com.linecorp.armeria:armeria MAVEN version 0.86.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.86.0 - com.linecorp.armeria:armeria-grpc-protocol 0.86.0 -...

cloud.opencode.base:opencode-base-token (1.0.0), io.github.junxworks:junx-ep-auth (>=2.0.0, <=2.1.0) +11 more potentially affected by CVE-2023-34478 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=2.0.0-alpha-2)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-2 Source cves: CVE-2023-34478 Source advisory: MEND:CVE-2023-34478...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +3 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.12.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

com.blitline:blitline-image-client-example (>=0.14.0, <=0.14.3), com.erudika:para (>=1.9.0, <=1.11) +43 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.8.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.blitline:blitline-image-client-example =0.14.0,...

cc.ccoke:validate-spring-boot-starter (>=0.1, <=0.5), cc.zenfery:springboot-starter-mds (>=0.1.1, <=0.1.2) +158 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.4.4.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - cc.ccoke:validate-spring-boot-starter =0.1, =0.1.1,...

com.fastjrun.codeg.apibase:sdkg-apibase-provider (>=3.1, <=3.2.4), com.fastjrun.codeg.example:sdkg-example-provider (>=2.1, <=3.0) +178 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.5.11.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.fastjrun.codeg.apibase:sdkg-apibase-provider...

com.piggsoft:beetl-spring-boot-autoconfigue (>=0.0.1, <=0.0.3), com.piggsoft:beetl-spring-boot-starter (>=0.0.1, <=0.0.3) potentially affected by CVE-2023-30331 via com.ibeetl:beetl (2.7.0)

com.ibeetl:beetl MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.ibeetl:beetl and may be impacted: - com.piggsoft:beetl-spring-boot-autoconfigue =0.0.1, =0.0.1, =0.0.3 Source cves: CVE-2023-30331 Source advisory:...

MAL-2023-1337 Malicious code in virgil-spring-boot-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d7b81762635da58744d7567d3ac4b1bf12da5d3c72070a9d2260d40463fcdbb The OpenSSF Package Analysis project identified 'virgil-spring-boot-starter' @ 20.0.0 npm as malicious. It is considered malicious because: - Th...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2023-20863 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

com.baomidou:mybatisplus-spring-boot-starter (1.0.2) potentially affected by CVE-2023-25330 via com.baomidou:mybatis-plus (2.0.9)

com.baomidou:mybatis-plus MAVEN version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.baomidou:mybatis-plus and may be impacted: - com.baomidou:mybatisplus-spring-boot-starter 1.0.2 Source cves: CVE-2023-25330 Source advisory:...

com.baomidou:mybatisplus-spring-boot-starter (1.0.3) potentially affected by CVE-2023-25330 via com.baomidou:mybatis-plus (2.1-beta)

com.baomidou:mybatis-plus MAVEN version 2.1-beta is affected by a known vulnerability. The following packages have a transitive dependency on com.baomidou:mybatis-plus and may be impacted: - com.baomidou:mybatisplus-spring-boot-starter 1.0.3 Source cves: CVE-2023-25330 Source advisory:...

io.undertow:undertow-servlet (1.1.9.final), io.undertow:undertow-websockets-jsr (1.1.9.final) +1 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.1.9.final)

io.undertow:undertow-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.9.final - io.undertow:undertow-websockets-jsr 1.1.9.final -...