Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2018-1000863Highorg.jenkins-ci.main:jenkins-core: Improper Limitation of a Pathname to a Restricted Directory in JenkinsCVE-2018-1000600Highcom.coravy.hudson.plugins.github:github: CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials CVE-2018-1000603Highorg.jenkins-ci.plugins:openstack-cloud: CSRF vulnerability and missing permission checks in Openstack Cloud Plugin allowed capturing credentials CVE-2018-1000608Loworg.jenkins-ci.plugins:zos-connector: Jenkins z/OS Connector Plugin allows local attacker to retrieve configured passwordCVE-2018-1000403Highcom.amazonaws:codedeploy: AWS CodeDeploy Plugin stored AWS Secret Key in plain textCVE-2018-1000401Highcom.amazonaws:aws-codepipeline: Jenkins AWS CodePipeline Plugin has Insufficiently Protected CredentialsCVE-2018-1000420Mediumorg.jenkins-ci.plugins:mesos: Improper authorization vulnerability in Jenkins Mesos PluginCVE-2018-1000408Mediumorg.jenkins-ci.main:jenkins-core: Improper Authorization in JenkinsCVE-2018-1000404Highcom.amazonaws:aws-codebuild: Insufficiently Protected Credentials in Jenkins AWS CodeBuild PluginCVE-2018-1000189Highorg.jenkins-ci.plugins:absint-astree: CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée PluginCVE-2018-1000197Highcom.blackducksoftware.integration:blackduck-hub: Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configurationCVE-2018-1000146Highorg.jenkins-ci.plugins:liquibase-runner: Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM CVE-2018-1000145Mediumorg.jvnet.hudson.plugins:perforce: Jenkins Perforce Plugin uses ineffective credentials encryptionCVE-2018-1000152Mediumorg.jenkins-ci.plugins:vsphere-cloud: Jenkins vSphere Plugin incorrect authorization vulnerabilityCVE-2018-1000134Criticalcom.unboundid:unboundid-ldapsdk: Weak Password Requirements in UnboundID LDAP SDKCVE-2018-1000114Mediumorg.jenkins-ci.plugins:promoted-builds: Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processesCVE-2018-1000112Mediumorg.jenkins-ci.plugins:mercurial: Incorrect Authorization in Jenkins Mercurial PluginCVE-2018-1000111Mediumorg.jenkins-ci.plugins:subversion: Jenkins Subversion Plugin Incorrect Authorization vulnerabilityCVE-2018-1000075Highrubygems-update: RubyGems Infinite Loop vulnerabilityCVE-2018-1000110Mediumorg.jenkins-ci.plugins:git: Incorrect Authorization in Jenkins Git PluginCVE-2018-1000106Mediumcom.sonyericsson.hudson.plugins.gerrit:gerrit-trigger: Incorrect Authorization in Jenkins Gerrit Trigger PluginCVE-2018-1000104Loworg.jenkins-ci.plugins:coverity: Jenkins Coverity Plugin has Insufficiently Protected CredentialsCVE-2018-1000109Mediumorg.jenkins-ci.plugins:google-play-android-publisher: Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDsCVE-2018-1000105Mediumcom.sonyericsson.hudson.plugins.gerrit:gerrit-trigger: Incorrect Authorization in Jenkins Gerrit Trigger PluginCVE-2018-1000107Mediumcom.synopsys.jenkinsci:ownership: Improper authorization in Jenkins Job and Node Ownership Plugin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo