search

Techini / vulnado

Purposely vulnerable Java application to help lead secure coding workshops
Apache License 2.0
0 stars 0 forks source link

[Snyk] Fix for 28 vulnerabilities #41

Open snyk-bot opened 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-455617		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-467014		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-467015		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-467016		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-469674		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-469676		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-471943		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-472980		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-540500		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-548451		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No Proof of Concept
high severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-559094		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No Proof of Concept
high severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-559106		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No Proof of Concept
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-560762		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-560766		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561362		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561373		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561585		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561586		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-561587		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-564887		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Deserialization of Untrusted Data
SNYK-JAVA-COMFASTERXMLJACKSONCORE-564888		 io.jsonwebtoken:jjwt-jackson:
0.10.5 -> 0.11.2
No No Known Exploit
low severity 369/1000
Why? Has a fix available, CVSS 3.1		 Session Fixation
SNYK-JAVA-ORGAPACHETOMCATEMBED-538488		 No No Known Exploit
high severity 791/1000
Why? Mature exploit, Has a fix available, CVSS 8.1		 Remote Code Execution (RCE)
SNYK-JAVA-ORGAPACHETOMCATEMBED-570072		 No Mature
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JAVA-ORGAPACHETOMCATEMBED-584427		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JAVA-ORGHIBERNATEVALIDATOR-568163		 No No Known Exploit
high severity 635/1000
Why? Has a fix available, CVSS 8.2		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGPOSTGRESQL-571481		 org.postgresql:postgresql:
42.2.5 -> 42.2.13
No No Known Exploit
high severity 614/1000
Why? Has a fix available, CVSS 8		 Reflected File Download (RFD)
SNYK-JAVA-ORGSPRINGFRAMEWORK-559346		 No No Known Exploit
medium severity 440/1000
Why? Has a fix available, CVSS 4.3		 Denial of Service (DoS)
SNYK-JAVA-ORGYAML-537645		 No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Vulnerabilities that could not be fixed

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: šŸ§ View latest project report

šŸ›  Adjust project settings

šŸ“š Read more about Snyk's upgrade and patch logic

sonarcloud[bot] commented 3 years ago

Kudos, SonarCloud Quality Gate passed!

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities (and Security Hotspot 0 Security Hotspots to review)
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication