Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2017-2609Mediumorg.jenkins-ci.main:jenkins-core: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins CVE-2017-2610Mediumorg.jenkins-ci.main:jenkins-core: Improper Neutralization of Input During Web Page Generation in Jenkins CVE-2017-2613Mediumorg.jenkins-ci.main:jenkins-core: Cross-Site Request Forgery in Jenkins CVE-2017-2606Mediumorg.jenkins-ci.main:jenkins-core: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins CVE-2017-2604Mediumorg.jenkins-ci.main:jenkins-core: Improper Authentication in Jenkins CVE-2017-2612Mediumorg.jenkins-ci.main:jenkins-core: Incorrect Permission Assignment for Critical Resource in Jenkins CVE-2017-2608Highorg.jenkins-ci.main:jenkins-core: Deserialization of Untrusted Data in Jenkins CVE-2017-2607Mediumorg.jenkins-ci.main:jenkins-core: Improper Neutralization of Input During Web Page Generation in Jenkins CVE-2017-2638Mediumorg.infinispan:infinispan-server-core: Infinispan Rest API Does Not Enforce Auth Constraints CVE-2017-2649Highorg.jenkins-ci.plugins:active-directory: Jenkins Active Directory Plugin did not verify certificate of AD server CVE-2017-2652Highorg.jenkins-ci.plugins:distfork: Missing permission checks in Jenkins Distributed Fork Plugin CVE-2017-2648Mediumorg.jenkins-ci.plugins:ssh-slaves: Jenkins SSH Build Agents Plugin did not verify host keys CVE-2017-2654Mediumorg.jenkins-ci.plugins:email-ext: Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin CVE-2017-2651Loworg.jenkins-ci.plugins:mailer: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin CVE-2017-2650Highcprice404:pipeline-classpath: Jenkins Pipeline Classpath Step plugin allowed Script Security sandbox bypass CVE-2017-3202Criticalcom.exadel.flamingo.flex:amf-serializer: Deserialization of Untrusted Data in Flamingo amf-serializer CVE-2017-3203Highorg.springframework.flex:spring-flex: Deserialization of Untrusted Data in Spring-flex CVE-2017-7545Mediumorg.jbpm.jbpm5:jbpmmigration: XML External Entity Reference in jbpmmigration CVE-2017-7556Highio.hawt:project: Cross-Site Request Forgery in hawtio CVE-2017-7559Mediumio.undertow:undertow-core: Undertow vulnerable to Request Smuggling CVE-2017-8446Mediumorg.elasticsearch.plugin:x-pack: Improper Privilege Management in X-Pack CVE-2018-1002202Mediumnet.lingala.zip4j:zip4j: Improper Limitation of a Pathname to a Restricted Directory in Zip4j CVE-2018-1002200Mediumorg.codehaus.plexus:plexus-archiver: Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver CVE-2018-10894Mediumorg.keycloak:keycloak-saml-adapter-core: Keycloak Authentication Error CVE-2018-14655Mediumorg.keycloak:keycloak-parent: Keycloak vulnerable to cross-site scripting via the state parameter

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo