Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2019-10347Highjavagh.jenkins:mashup-portlets-plugin: Stored credentials unencrypted in Jenkins Mashup Portlets Plugin CVE-2018-17196Highorg.apache.kafka:kafka: Improper Input Validation in Apache Kafka CVE-2019-10333Mediumorg.jenkins-ci.plugins:electricflow: Jenkins ElectricFlow Plugin Missing permission checks CVE-2019-10335Mediumorg.jenkins-ci.plugins:electricflow: Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability CVE-2019-10332Mediumorg.jenkins-ci.plugins:electricflow: Jenkins ElectricFlow Plugin missing permission check CVE-2019-10331Mediumorg.jenkins-ci.plugins:electricflow: Jenkins ElectricFlow Plugin cross-site request forgery vulnerability CVE-2019-10334Mediumorg.jenkins-ci.plugins:electricflow: Jenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation CVE-2019-10338Mediumorg.jenkins-ci.plugins:jx-resources: Jenkins JX Resources Plugin cross-site request forgery vulnerability CVE-2019-10339Mediumorg.jenkins-ci.plugins:jx-resources: Jenkins JX Resources Plugin missing permission check CVE-2019-10337Highorg.jenkins-ci.plugins:token-macro: Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin CVE-2019-10336Mediumorg.jenkins-ci.plugins:electricflow: Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability CVE-2019-12728Highorg.grails:grails-core: Incorrect Resource Transfer Between Spheres in Grails CVE-2019-6588Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API CVE-2019-10319Mediumorg.jenkins-ci.plugins:pam-auth: Missing permission check in Jenkins PAM Authentication Plugin CVE-2016-10750Highcom.hazelcast:hazelcast: Deserialization of Untrusted Data in Hazelcast CVE-2019-10320Mediumorg.jenkins-ci.plugins:credentials: Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin CVE-2016-7043Criticalorg.kie.server:kie-server-common: Password in config file in KIE server CVE-2019-0226Mediumorg.apache.karaf.config:org.apache.karaf.config.core: Apache Karaf vulnerable to relative path traversal CVE-2019-11819Highorg.opencms:opencms-core: Alkacon OpenCMS CSV Injection via New User module CVE-2019-10249Highorg.eclipse.xtext:org.eclipse.xtext: Potentially compromised builds CVE-2019-10318Loworg.jenkins-ci.plugins:azure-ad: Jenkins Azure AD Plugin stored the client secret unencrypted CVE-2019-10316Loworg.jenkins-ci.plugins:aqua-microscanner: Jenkins Aqua MicroScanner Plugin stored credentials in plain text CVE-2019-10311Highorg.jenkins-ci.plugins:ansible-tower: Jenkins Ansible Tower Plugin missing permission check CVE-2019-10310Mediumorg.jenkins-ci.plugins:ansible-tower: Jenkins Ansible Tower Plugin cross-site request forgery vulnerability CVE-2019-10317Mediumorg.jvnet.hudson.plugins:sitemonitor: Jenkins SiteMonitor Plugin globally and unconditionally disables SSL/TLS certificate validation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo