net.bull.javamelody:javamelody-core@1.10.0 vulnerabilities

latest version

2.4.0

latest non vulnerable version

2.4.0

first published

14 years ago

latest version published

19 days ago

licenses detected

LGPL-3.0
[1.8.1,1.50.0)

package manager

View on Maven Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the net.bull.javamelody:javamelody-core package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) net.bull.javamelody:javamelody-core is a JavaEE application monitoring module. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `counter` parameter in a `clear_counter` action to the /monitoring URI. How to fix Cross-site Scripting (XSS)? Upgrade `net.bull.javamelody:javamelody-core` to version 1.61.0 or higher.	[,1.61.0)
M Cross-site Scripting (XSS) `net.bull.javamelody:javamelody-core` monitors JavaEE applications. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks.	[,1.53.0)
M Cross-site Scripting (XSS) `net.bull.javamelody:javamelody-core` monitors JavaEE applications. Cross-site Scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.	[,1.46.0)

Go back to all versions of this package