Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 62 vulnerabilities #1

Merged
merged 1 commit into from
Oct 24, 2024
Merged

[Snyk] Fix for 62 vulnerabilities #1

merged 1 commit into from
Oct 24, 2024

Conversation

ManPrivate
Copy link
Owner

snyk-top-banner

Snyk has created this PR to fix 62 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

  • todolist-goof/todolist-web-struts/pom.xml
  • todolist-goof/pom.xml

Vulnerabilities that will be fixed with an upgrade:

Issue Score Upgrade
critical severity Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720		   800   org.apache.logging.log4j:log4j-core:
2.7 -> 2.13.2
No Path Found Mature
critical severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHESTRUTS-30207		   800   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
critical severity Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHESTRUTS-1049003		   790   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
critical severity Arbitrary Command Execution
SNYK-JAVA-ORGAPACHESTRUTS-30772		   790   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
critical severity Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHESTRUTS-6102825		   790   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
critical severity Deserialization of Untrusted Data
SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31409		   760   org.apache.logging.log4j:log4j-core:
2.7 -> 2.13.2
No Path Found Mature
critical severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHESTRUTS-31503		   760   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
critical severity Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHESTRUTS-608097		   760   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
critical severity Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014		   750   org.apache.logging.log4j:log4j-core:
2.7 -> 2.13.2
No Path Found Mature
high severity Command Injection
SNYK-JAVA-ORGAPACHESTRUTS-30770		   705   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
high severity Arbitrary Command Execution
SNYK-JAVA-ORGAPACHESTRUTS-31495		   705   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
high severity Remote Code Execution
SNYK-JAVA-ORGAPACHESTRUTS-32477		   705   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Mature
high severity Command Injection
SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611		   705   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found Mature
critical severity Arbitrary Code Execution
SNYK-JAVA-COMMONSFILEUPLOAD-30401		   640   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
critical severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHESTRUTS-30771		   640   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
critical severity Directory Traversal
SNYK-JAVA-ORGAPACHESTRUTS-30778		   640   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
critical severity Improper Action Name Cleanup
SNYK-JAVA-ORGAPACHESTRUTS-451610		   640   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHESTRUTS-2635340		   630   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Proof of Concept
high severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2321524		   600   org.apache.logging.log4j:log4j-core:
2.7 -> 2.13.2
No Path Found Proof of Concept
high severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHESTRUTS-608098		   600   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found Proof of Concept
high severity Server-side Template Injection (SSTI)
SNYK-JAVA-ORGFREEMARKER-1076795		   600   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found Proof of Concept
high severity Cross-site Request Forgery (CSRF)
SNYK-JAVA-ORGAPACHESTRUTS-30774		   590   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Unrestricted Upload of File with Dangerous Type
SNYK-JAVA-ORGAPACHESTRUTS-609765		   590   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Improper Input Validation
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799		   590   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
high severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803		   590   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
high severity Improper Input Validation
SNYK-JAVA-ORGAPACHESTRUTSXWORK-5811864		   590   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
high severity XML External Entity (XXE) Injection
SNYK-JAVA-ORGSPRINGFRAMEWORK-30163		   590   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
No Path Found No Known Exploit
high severity Improper Input Validation
SNYK-JAVA-ORGSPRINGFRAMEWORK-1009832		   580   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
high severity Reflected File Download
SNYK-JAVA-ORGSPRINGFRAMEWORK-30165		   580   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
No Path Found No Known Exploit
medium severity Arbitrary File Write via Archive Extraction (Zip Slip)
SNYK-JAVA-ORGZEROTURNAROUND-31681		   575   org.zeroturnaround:zt-zip:
1.12 -> 1.13
Reachable No Known Exploit
medium severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2327339		   555   org.apache.logging.log4j:log4j-core:
2.7 -> 2.13.2
No Path Found Proof of Concept
medium severity Directory Traversal
SNYK-JAVA-COMMONSIO-1277109		   535   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
Major version upgrade No Path Found Mature
high severity Denial of Service (DoS)
SNYK-JAVA-COMMONSFILEUPLOAD-30082		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
high severity Manipulation of Struts' internals
SNYK-JAVA-ORGAPACHESTRUTS-30060		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Access Restriction Bypass
SNYK-JAVA-ORGAPACHESTRUTS-30775		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Access Restriction Bypass
SNYK-JAVA-ORGAPACHESTRUTS-30776		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHESTRUTS-31500		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHESTRUTS-31501		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHESTRUTS-31502		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
high severity Parameter Alteration
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
high severity Access Restriction Bypass
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802		   525   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
high severity Insecure Defaults
SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418		   515   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
high severity Open Redirect
SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586		   505   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
high severity Open Redirect
SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790		   505   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447		   495   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
medium severity Information Exposure
SNYK-JAVA-COMMONSFILEUPLOAD-31540		   475   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-COMMONSFILEUPLOAD-3326457		   475   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
Major version upgrade No Path Found No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217		   475   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
medium severity Cross-site Request Forgery (CSRF)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31331		   465   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
No Path Found No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHESTRUTS-30773		   455   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800		   455   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-30164		   425   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
No Path Found No Known Exploit
medium severity Open Redirect
SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980		   420   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-OGNL-30474		   415   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JAVA-ORGAPACHESTRUTS-460223		   415   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
medium severity Denial of Service
SNYK-JAVA-ORGAPACHESTRUTS-6100744		   415   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
medium severity Improper Input Validation
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801		   415   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804		   415   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828		   415   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749		   415   org.springframework:spring-web:
3.2.6.RELEASE -> 5.3.38
Major version upgrade No Path Found No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGAPACHESTRUTS-5707101		   365   org.apache.struts:struts2-core:
2.3.20 -> 6.1.2
org.apache.struts:struts2-spring-plugin:
2.3.20 -> 2.5.33
No Path Found No Known Exploit
low severity Man-in-the-Middle (MitM)
SNYK-JAVA-ORGAPACHELOGGINGLOG4J-567761		   335   org.apache.logging.log4j:log4j-core:
2.7 -> 2.13.2
No Path Found No Known Exploit

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Arbitrary Code Execution
🦉 Denial of Service (DoS)
🦉 More lessons are available in Snyk Learn

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"org.apache.logging.log4j:log4j-core","from":"2.7","to":"2.13.2"},{"name":"org.apache.struts:struts2-core","from":"2.3.20","to":"6.1.2"},{"name":"org.apache.struts:struts2-spring-plugin","from":"2.3.20","to":"2.5.33"},{"name":"org.springframework:spring-web","from":"3.2.6.RELEASE","to":"5.3.38"},{"name":"org.zeroturnaround:zt-zip","from":"1.12","to":"1.13"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMMONSFILEUPLOAD-30082","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMMONSFILEUPLOAD-30401","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMMONSFILEUPLOAD-31540","priority_score":475,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Information Exposure"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-COMMONSFILEUPLOAD-3326457","priority_score":475,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-COMMONSIO-1277109","priority_score":535,"priority_score_factors":[{"type":"exploit","label":"Functional","score":120},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Directory Traversal"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-COMMONSIO-1277109","priority_score":535,"priority_score_factors":[{"type":"exploit","label":"Functional","score":120},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Directory Traversal"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-OGNL-30474","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-OGNL-30474","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720","priority_score":800,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"10","score":500},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014","priority_score":750,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9","score":450},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2321524","priority_score":600,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2327339","priority_score":555,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.6","score":330},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Arbitrary Code Execution"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31409","priority_score":760,"priority_score_factors":[{"type":"exploit","label":"Functional","score":120},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Deserialization of Untrusted Data"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHELOGGINGLOG4J-567761","priority_score":335,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"3.7","score":185},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Man-in-the-Middle (MitM)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-1049003","priority_score":790,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGAPACHESTRUTS-2635340","priority_score":630,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30060","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Manipulation of Struts' internals"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-30207","priority_score":800,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"10","score":500},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-30770","priority_score":705,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Command Injection"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30771","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-30772","priority_score":790,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Command Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30773","priority_score":455,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30774","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Cross-site Request Forgery (CSRF)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30775","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Access Restriction Bypass"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30776","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Access Restriction Bypass"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30778","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Directory Traversal"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-31495","priority_score":705,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary Command Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-31500","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-31501","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-31502","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-31503","priority_score":760,"priority_score_factors":[{"type":"exploit","label":"Functional","score":120},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-32477","priority_score":705,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-451610","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Improper Action Name Cleanup"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-460223","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-5707101","priority_score":365,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"4.3","score":215},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-608097","priority_score":760,"priority_score_factors":[{"type":"exploit","label":"Functional","score":120},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGAPACHESTRUTS-608098","priority_score":600,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-609765","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Unrestricted Upload of File with Dangerous Type"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-6100744","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-6102825","priority_score":790,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-1049003","priority_score":790,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGAPACHESTRUTS-2635340","priority_score":630,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30060","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Manipulation of Struts' internals"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-30207","priority_score":800,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"10","score":500},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-30770","priority_score":705,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Command Injection"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30771","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-30772","priority_score":790,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Command Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30773","priority_score":455,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30774","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Cross-site Request Forgery (CSRF)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30775","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Access Restriction Bypass"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30776","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Access Restriction Bypass"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-30778","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Directory Traversal"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-31495","priority_score":705,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary Command Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-31500","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-31501","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-31502","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-31503","priority_score":760,"priority_score_factors":[{"type":"exploit","label":"Functional","score":120},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-32477","priority_score":705,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-451610","priority_score":640,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Improper Action Name Cleanup"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-460223","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-5707101","priority_score":365,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"4.3","score":215},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-608097","priority_score":760,"priority_score_factors":[{"type":"exploit","label":"Functional","score":120},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGAPACHESTRUTS-608098","priority_score":600,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-609765","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Unrestricted Upload of File with Dangerous Type"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTS-6100744","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTS-6102825","priority_score":790,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Parameter Alteration"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Input Validation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800","priority_score":455,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Improper Input Validation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802","priority_score":525,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Access Restriction Bypass"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary Code Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"Mature","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611","priority_score":705,"priority_score_factors":[{"type":"exploit","label":"High","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Command Injection"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418","priority_score":515,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Insecure Defaults"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGAPACHESTRUTSXWORK-5811864","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Input Validation"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JAVA-ORGFREEMARKER-1076795","priority_score":600,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":75},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Server-side Template Injection (SSTI)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-1009832","priority_score":580,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.6","score":430},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Input Validation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-30163","priority_score":590,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"XML External Entity (XXE) Injection"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-30164","priority_score":425,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.5","score":275},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-30165","priority_score":580,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"8.6","score":430},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Reflected File Download"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-31331","priority_score":465,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.3","score":315},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Request Forgery (CSRF)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Open Redirect"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790","priority_score":505,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"7.1","score":355},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Open Redirect"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980","priority_score":420,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Open Redirect"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447","priority_score":495,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.9","score":345},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749","priority_score":415,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217","priority_score":475,"priority_score_factors":[{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JAVA-ORGZEROTURNAROUND-31681","priority_score":575,"priority_score_factors":[{"type":"reachabilityBucket","label":"reachable","score":150},{"type":"fixability","label":true,"score":150},{"type":"cvssScore","label":"5.5","score":275},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Arbitrary File Write via Archive Extraction (Zip Slip)"}],"prId":"c7858c6c-9e7f-4bc5-9da3-817533fb7f90","prPublicId":"c7858c6c-9e7f-4bc5-9da3-817533fb7f90","packageManager":"maven","priorityScoreList":[525,640,475,475,535,415,800,750,600,555,760,335,790,630,525,800,705,640,790,455,590,525,525,640,705,525,525,525,760,705,640,415,365,760,600,590,415,790,525,590,455,415,525,590,415,705,515,590,600,580,590,425,580,465,505,505,420,495,415,415,475,575],"projectPublicId":"fe701c34-b264-494d-9aa2-b07289b9de46","projectUrl":"https://app.snyk.io/org/man.private2000/project/fe701c34-b264-494d-9aa2-b07289b9de46?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"user-initiated","upgrade":["SNYK-JAVA-COMMONSFILEUPLOAD-30082","SNYK-JAVA-COMMONSFILEUPLOAD-30401","SNYK-JAVA-COMMONSFILEUPLOAD-31540","SNYK-JAVA-COMMONSFILEUPLOAD-3326457","SNYK-JAVA-COMMONSIO-1277109","SNYK-JAVA-OGNL-30474","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2321524","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2327339","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31409","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-567761","SNYK-JAVA-ORGAPACHESTRUTS-1049003","SNYK-JAVA-ORGAPACHESTRUTS-2635340","SNYK-JAVA-ORGAPACHESTRUTS-30060","SNYK-JAVA-ORGAPACHESTRUTS-30207","SNYK-JAVA-ORGAPACHESTRUTS-30770","SNYK-JAVA-ORGAPACHESTRUTS-30771","SNYK-JAVA-ORGAPACHESTRUTS-30772","SNYK-JAVA-ORGAPACHESTRUTS-30773","SNYK-JAVA-ORGAPACHESTRUTS-30774","SNYK-JAVA-ORGAPACHESTRUTS-30775","SNYK-JAVA-ORGAPACHESTRUTS-30776","SNYK-JAVA-ORGAPACHESTRUTS-30778","SNYK-JAVA-ORGAPACHESTRUTS-31495","SNYK-JAVA-ORGAPACHESTRUTS-31500","SNYK-JAVA-ORGAPACHESTRUTS-31501","SNYK-JAVA-ORGAPACHESTRUTS-31502","SNYK-JAVA-ORGAPACHESTRUTS-31503","SNYK-JAVA-ORGAPACHESTRUTS-32477","SNYK-JAVA-ORGAPACHESTRUTS-451610","SNYK-JAVA-ORGAPACHESTRUTS-460223","SNYK-JAVA-ORGAPACHESTRUTS-5707101","SNYK-JAVA-ORGAPACHESTRUTS-608097","SNYK-JAVA-ORGAPACHESTRUTS-608098","SNYK-JAVA-ORGAPACHESTRUTS-609765","SNYK-JAVA-ORGAPACHESTRUTS-6100744","SNYK-JAVA-ORGAPACHESTRUTS-6102825","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804","SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611","SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418","SNYK-JAVA-ORGAPACHESTRUTSXWORK-5811864","SNYK-JAVA-ORGFREEMARKER-1076795","SNYK-JAVA-ORGSPRINGFRAMEWORK-1009832","SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828","SNYK-JAVA-ORGSPRINGFRAMEWORK-30163","SNYK-JAVA-ORGSPRINGFRAMEWORK-30164","SNYK-JAVA-ORGSPRINGFRAMEWORK-30165","SNYK-JAVA-ORGSPRINGFRAMEWORK-31331","SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749","SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217","SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586","SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790","SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980","SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447","SNYK-JAVA-ORGZEROTURNAROUND-31681"],"vulns":["SNYK-JAVA-COMMONSFILEUPLOAD-30082","SNYK-JAVA-COMMONSFILEUPLOAD-30401","SNYK-JAVA-COMMONSFILEUPLOAD-31540","SNYK-JAVA-COMMONSFILEUPLOAD-3326457","SNYK-JAVA-COMMONSIO-1277109","SNYK-JAVA-OGNL-30474","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2321524","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2327339","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31409","SNYK-JAVA-ORGAPACHELOGGINGLOG4J-567761","SNYK-JAVA-ORGAPACHESTRUTS-1049003","SNYK-JAVA-ORGAPACHESTRUTS-2635340","SNYK-JAVA-ORGAPACHESTRUTS-30060","SNYK-JAVA-ORGAPACHESTRUTS-30207","SNYK-JAVA-ORGAPACHESTRUTS-30770","SNYK-JAVA-ORGAPACHESTRUTS-30771","SNYK-JAVA-ORGAPACHESTRUTS-30772","SNYK-JAVA-ORGAPACHESTRUTS-30773","SNYK-JAVA-ORGAPACHESTRUTS-30774","SNYK-JAVA-ORGAPACHESTRUTS-30775","SNYK-JAVA-ORGAPACHESTRUTS-30776","SNYK-JAVA-ORGAPACHESTRUTS-30778","SNYK-JAVA-ORGAPACHESTRUTS-31495","SNYK-JAVA-ORGAPACHESTRUTS-31500","SNYK-JAVA-ORGAPACHESTRUTS-31501","SNYK-JAVA-ORGAPACHESTRUTS-31502","SNYK-JAVA-ORGAPACHESTRUTS-31503","SNYK-JAVA-ORGAPACHESTRUTS-32477","SNYK-JAVA-ORGAPACHESTRUTS-451610","SNYK-JAVA-ORGAPACHESTRUTS-460223","SNYK-JAVA-ORGAPACHESTRUTS-5707101","SNYK-JAVA-ORGAPACHESTRUTS-608097","SNYK-JAVA-ORGAPACHESTRUTS-608098","SNYK-JAVA-ORGAPACHESTRUTS-609765","SNYK-JAVA-ORGAPACHESTRUTS-6100744","SNYK-JAVA-ORGAPACHESTRUTS-6102825","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803","SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804","SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611","SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418","SNYK-JAVA-ORGAPACHESTRUTSXWORK-5811864","SNYK-JAVA-ORGFREEMARKER-1076795","SNYK-JAVA-ORGSPRINGFRAMEWORK-1009832","SNYK-JAVA-ORGSPRINGFRAMEWORK-30163","SNYK-JAVA-ORGSPRINGFRAMEWORK-30164","SNYK-JAVA-ORGSPRINGFRAMEWORK-30165","SNYK-JAVA-ORGSPRINGFRAMEWORK-31331","SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586","SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790","SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980","SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447","SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828","SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749","SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217","SNYK-JAVA-ORGZEROTURNAROUND-31681"],"patch":[],"isBreakingChange":true,"remediationStrategy":"vuln"}'

@snyk-bot
fix: todolist-goof/todolist-web-struts/pom.xml & todolist-goof/pom.xm…
d9a5bd4 
…l to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30207
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-1049003
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30772
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-6102825
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-31409
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31503
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-608097
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30770
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31495
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-32477
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611
- https://snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30401
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30771
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30778
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-451610
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-2635340
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2321524
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-608098
- https://snyk.io/vuln/SNYK-JAVA-ORGFREEMARKER-1076795
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30774
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-609765
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-5811864
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30163
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-1009832
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30165
- https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2327339
- https://snyk.io/vuln/SNYK-JAVA-COMMONSIO-1277109
- https://snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30060
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30775
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30776
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31500
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31501
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31502
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447
- https://snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-31540
- https://snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-3326457
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31331
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30773
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30164
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980
- https://snyk.io/vuln/SNYK-JAVA-OGNL-30474
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-460223
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-6100744
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-5707101
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-567761
@ManPrivate ManPrivate merged commit 221cad5 into main Oct 24, 2024
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ManPrivate @snyk-bot