Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2018-1000609Mediumio.jenkins:configuration-as-code: Jenkins Configuration as Code Plugin vulnerable to Exposure of Sensitive InformationCVE-2018-13439Highcom.github.wxpay:wxpay-sdk: WeChat Pay Java SDK allows XXECVE-2018-1000402Mediumcom.amazonaws:codedeploy: Jenkins AWS CodeDeploy Plugin has Insufficiently Protected CredentialsCVE-2018-14380Mediumorg.graylog2:graylog2-server: Cross-site Scripting in Graylog ServerCVE-2018-14371Highorg.glassfish:mojarra-parent: Path Traversal in Eclipse MojarraCVE-2018-1999029Mediumorg.jenkins-ci.plugins:shelve-project-plugin: Stored Cross-Site Scripting Vulnerability in Jenkins Shelve Project PluginCVE-2018-1999031Loworg.jenkins-ci.plugins:meliora-testlab: Jenkins meliora-testlab Plugin allows attackers with file system access to Jenkins master to obtain API keyCVE-2018-1999041Mediumcom.tinfoilsecurity.plugins:tinfoil-scan: Exposure of sensitive information vulnerabilityCVE-2015-0227Mediumorg.apache.ws.security:wss4j: Improper Access Control in Apache WSS4JCVE-2018-1999025Highde.tracetronic.jenkins.plugins:ecutest: Jenkins TraceTronic ECU-TEST Plugin Man in the middle vulnerabilityCVE-2018-1999026Mediumde.tracetronic.jenkins.plugins:ecutest: Jenkins TraceTronic ECU-TEST Plugin server-side request forgery vulnerabilityCVE-2018-1999035Highcom.inedo.buildmaster:inedo-buildmaster: Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validationCVE-2018-1999034Highcom.inedo.proget:inedo-proget: Jenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validationCVE-2018-1000605Mediumorg.jenkins-ci.plugins:collabnet: Jenkins CollabNet Plugin man in the middle vulnerabilityCVE-2011-0534Highorg.apache.tomcat:tomcat: Apache Tomcat does not enforce the maxHttpHeaderSize limitCVE-2011-0533Mediumorg.apache.archiva:archiva: Apache Continuum and Archiva vulnerable to Cross-site ScriptingCVE-2011-1088Mediumorg.apache.tomcat:tomcat: Apache Tomcat allows remote attackers to bypass intended access restrictionsCVE-2011-1183Mediumorg.apache.tomcat:tomcat: Access controll bypass in Apache TomcatCVE-2011-1582Mediumorg.apache.tomcat:tomcat: Access restriction bypass in Apache TomcatCVE-2011-2088Mediumorg.apache.struts.xwork:xwork-core: XWork in Apache Struts Reveals Sensitive InformationCVE-2011-2894Mediumorg.springframework:spring-core: Spring Framework and Spring Security vulnerable to Deserialization of Untrusted DataCVE-2013-5855Mediumorg.glassfish:javax.faces: Improper Neutralization of Input During Web Page Generation in MojarraCVE-2013-6235Mediumcom.jamonapi:jamon: Improper Neutralization of Input During Web Page Generation in JAMonCVE-2014-3503Mediumorg.apache.syncope:syncope: Apache Syncope uses a weak PNRGCVE-2014-6439Mediumorg.elasticsearch:elasticsearch: Cross-site scripting in Elasticsearch

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo