Maven Package Vulnerabilities
Vulnerabilities associated with org.apache.unomi:unomi.
Packages
Clear package- org.jenkins-ci.main:jenkins-core257 vulnerabilities
- org.apache.tomcat:tomcat160 vulnerabilities
- com.liferay.portal:release.portal.bom159 vulnerabilities
- com.liferay.portal:release.dxp.bom125 vulnerabilities
- org.keycloak:keycloak-services97 vulnerabilities
- com.fasterxml.jackson.core:jackson-databind80 vulnerabilities
- org.apache.tomcat.embed:tomcat-embed-core74 vulnerabilities
- org.apache.struts:struts2-core60 vulnerabilities
- org.keycloak:keycloak-core50 vulnerabilities
- org.xwiki.platform:xwiki-platform-oldcore46 vulnerabilities
- org.elasticsearch:elasticsearch44 vulnerabilities
- net.mingsoft:ms-mcms39 vulnerabilities
- org.apache.tomcat:tomcat-catalina39 vulnerabilities
- io.undertow:undertow-core38 vulnerabilities
- com.thoughtworks.xstream:xstream37 vulnerabilities
- com.jfinal:jfinal36 vulnerabilities
- org.jenkins-ci.plugins:script-security35 vulnerabilities
- org.apache.solr:solr-core31 vulnerabilities
- org.apache.tomcat:tomcat-coyote31 vulnerabilities
- org.opencms:opencms-core31 vulnerabilities
- org.springframework.security:spring-security-core31 vulnerabilities
- org.eclipse.jetty:jetty-server29 vulnerabilities
- org.bouncycastle:bcprov-jdk1426 vulnerabilities
- org.apache.openmeetings:openmeetings-parent25 vulnerabilities
- org.keycloak:keycloak-parent25 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-31164HIGH | Apache Unomi log injectionApache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements. | CVSS7.5v3.1 | EPSS2.28% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-13942CRITICAL | Remote Code Execution in Apache UnomiIt is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem. | CVSS9.8v3.1 | EPSS68.4% | PoCs8 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2020-11975CRITICAL | Improper Input Validation in Apache UnomiApache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process. | CVSS9.8v3.1 | EPSS29.9% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |