org.directwebremoting:dwr@2.0.1 vulnerabilities
latest version
3.0.2-RELEASE
latest non vulnerable version
first published
18 years ago
latest version published
8 years ago
licenses detected
- [2.0.rc1,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.directwebremoting:dwr package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.directwebremoting:dwr is a Java library that enables Java on the server and JavaScript in a browser to interact and call each other Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. How to fix Cross-site Scripting (XSS)? Upgrade | [,2.0.11)[3-alpha,3.0.RC3) |
org.directwebremoting:dwr is a Java library that enables Java on the server and JavaScript in a browser to interact and call each other Affected versions of this package are vulnerable to Information Exposure. The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. How to fix Information Exposure? Upgrade | [,2.0.11)[3-alpha,3.0.RC3) |