There is no fixed version for RHEL:7 grafana .

com.xuxueli:xxl-job 2.4.2 vulnerabilities

Known vulnerabilities in the com.xuxueli:xxl-job package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via injection into logs on the `/xxl-job-admin/joblog/logDetailPage` endpoint. How to fix Cross-site Scripting (XSS)? There is no fixed version for `com.xuxueli:xxl-job`.	[0,)
M Information Exposure com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Information Exposure on the `/xxl-job-admin/joblog/clearLog` and `/xxl-job-admin/joblog/logDetailCat` functions. A low privileged user can expose or delete log data that they are not authorized to access. How to fix Information Exposure? There is no fixed version for `com.xuxueli:xxl-job`.	[0,)
M HTML Injection com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to HTML Injection. HTML uploaded payload executed successfully through `/xxl-job-admin/user/add` and `/xxl-job-admin/user/update`. How to fix HTML Injection? There is no fixed version for `com.xuxueli:xxl-job`.	[0,)
M Information Exposure com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Information Exposure via the `pageList` parameter. How to fix Information Exposure? There is no fixed version for `com.xuxueli:xxl-job`.	[2.2.0,)
M Cross-site Scripting (XSS) com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the task management, due to improper input sanitization. How to fix Cross-site Scripting (XSS)? There is no fixed version for `com.xuxueli:xxl-job`.	[0,)
M Cross-site Request Forgery (CSRF) com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) that allows attackers to arbitrarily create administrator accounts, modify passwords, perform task scheduling and other operations via the `/gaia-job-admin/user/add` component. How to fix Cross-site Request Forgery (CSRF)? There is no fixed version for `com.xuxueli:xxl-job`.	[0,)
H Cross-site Scripting (XSS) com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `AppName` or `AddressList` parameters in `JobGroupController.java` file. How to fix Cross-site Scripting (XSS)? There is no fixed version for `com.xuxueli:xxl-job`.	[0,)
H Information Disclosure com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Information Disclosure of `username`, `model`, and `password` via `job/admin/controller/UserController.java`. How to fix Information Disclosure? There is no fixed version for `com.xuxueli:xxl-job`.	[0,)

Vulnerability

Vulnerable Version

Cross-site Scripting (XSS)

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via injection into logs on the /xxl-job-admin/joblog/logDetailPage endpoint.

How to fix Cross-site Scripting (XSS)?