Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2017-5648Criticalorg.apache.tomcat:tomcat-catalina: Exposure of Resource to Wrong Sphere in Apache Tomcat CVE-2011-1571Mediumcom.liferay.portal:portal-service: Liferay Portal vulnerable to arbitrary command injection CVE-2013-4366Criticalorg.apache.httpcomponents:httpclient: Hostname verification in Apache HttpClient 4.3 was disabled by default CVE-2011-4367Mediumorg.apache.myfaces.core:myfaces-impl: Apache MyFaces Vulnerable to Path Traversal CVE-2016-5388Highorg.apache.tomcat:tomcat-catalina: Improper Access Control in Apache Tomcat CVE-2017-12160Highorg.keycloak:keycloak-parent: Keycloak Oauth Implementation Error CVE-2019-6986Highorg.vivoweb:vitro-project: Command Injection in VIVO Vitro CVE-2019-11065Mediumorg.gradle:gradle-core: Insecure transport protocol in Gradle CVE-2018-8015Highorg.apache.orc:orc: Apache ORC vulnerable to Uncontrolled Recursion CVE-2018-18240Criticalro.pippo:pippo-core: Pippo RCE Vulnerability CVE-2018-12532Criticalorg.richfaces:richfaces-core: RichFaces vulnerable to Expression Language Injection CVE-2018-12533Criticalorg.richfaces:richfaces-core: Arbitrary code execution in Richfaces CVE-2018-1000412Mediumorg.jenkins-ci.plugins:jira: Jenkins Jira Plugin Incorrect Authorization vulnerability CVE-2018-1000418Highorg.jvnet.hudson.plugins:hipchat: Jenkins HipChat Plugin allows credential capture due to incorrect authorization CVE-2018-1000425Highorg.jenkins-ci.plugins:sonar: Jenkins SonarQube Scanner Plugin stored server authentication token in plain text CVE-2018-1000424Highorg.jenkins-ci.plugins:artifactory: Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk CVE-2018-1000419Mediumorg.jvnet.hudson.plugins:hipchat: Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs CVE-2018-1000423Highorg.jenkins-ci.plugins:crowd2: Jenkins Crowd 2 Integration Plugin stored credentials in plain text CVE-2018-1000149Mediumorg.jenkins-ci.plugins:ansible: Jenkins Ansible Plugin man in the middle vulnerability CVE-2018-1000073Highrubygems-update: RubyGems Link Following vulnerability CVE-2018-1000015Mediumorg.jenkins-ci.plugins.workflow:workflow-durable-task-step: Incorrect permission checks in Pipeline: Nodes and Processes plugin CVE-2017-1000390Mediumorg.jenkins-ci.plugins:jenkins-multijob-plugin: Jenkins Multijob plugin did not check permissions in the Resume Build action CVE-2017-1000105Mediumio.jenkins.blueocean:blueocean: Missing Authorization in Jenkins Blue Ocean Plugin CVE-2017-1000388Mediumorg.jenkins-ci.plugins:depgraph-view: Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks CVE-2017-15695Highorg.apache.geode:geode-core: Apache Geode vulnerable to Incorrect Authorization

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo