Vulnerabilities

 3 via 3 paths

Dependencies

 19

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 3
  • 3
Severity
  • 2
  • 4
Status
  • 6
  • 0
  • 0

high severity

Uncontrolled Recursion

  • Vulnerable module: commons-lang:commons-lang
  • Introduced through: commons-lang:commons-lang@2.6

Detailed paths

  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › commons-lang:commons-lang@2.6

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

There is no fixed version for commons-lang:commons-lang.

References

Uncontrolled Recursion vulnerability report

high severity
new

Incorrect Authorization

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.22.0

Detailed paths

  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › com.fasterxml.jackson.core:jackson-databind@2.22.0
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.22.1.

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incorrect Authorization in the deserialization process when handling properties annotated with both @JsonView and @JsonUnwrapped. An attacker can modify data that should be restricted to a higher-privileged view by supplying crafted JSON input.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

Incorrect Authorization vulnerability report

medium severity
new

Improperly Controlled Modification of Dynamically-Determined Object Attributes

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: com.fasterxml.jackson.core:jackson-databind@2.22.0

Detailed paths

  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › com.fasterxml.jackson.core:jackson-databind@2.22.0
    Remediation: Upgrade to com.fasterxml.jackson.core:jackson-databind@2.22.1.

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability report

medium severity

LGPL-2.1 license

  • Module: com.openhtmltopdf:openhtmltopdf-core
  • Introduced through: com.openhtmltopdf:openhtmltopdf-pdfbox@1.0.10

Detailed paths

  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › com.openhtmltopdf:openhtmltopdf-pdfbox@1.0.10 › com.openhtmltopdf:openhtmltopdf-core@1.0.10

LGPL-2.1 license

LGPL-2.1 license vulnerability report

medium severity

LGPL-2.1 license

  • Module: com.openhtmltopdf:openhtmltopdf-pdfbox
  • Introduced through: com.openhtmltopdf:openhtmltopdf-pdfbox@1.0.10

Detailed paths

  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › com.openhtmltopdf:openhtmltopdf-pdfbox@1.0.10

LGPL-2.1 license

LGPL-2.1 license vulnerability report

medium severity

EPL-1.0 license

  • Module: junit:junit
  • Introduced through: org.apache.pdfbox:pdfbox@2.0.24 and com.openhtmltopdf:openhtmltopdf-pdfbox@1.0.10

Detailed paths

  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › org.apache.pdfbox:pdfbox@2.0.24 › org.apache.pdfbox:fontbox@2.0.24 › junit:junit@4.13.2
  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › com.openhtmltopdf:openhtmltopdf-pdfbox@1.0.10 › org.apache.pdfbox:xmpbox@2.0.24 › junit:junit@4.13.2
  • Introduced through: WouterVerleur/D-D-Charactersheets-and-battle-control@WouterVerleur/D-D-Charactersheets-and-battle-control › com.openhtmltopdf:openhtmltopdf-pdfbox@1.0.10 › org.apache.pdfbox:pdfbox@2.0.24 › org.apache.pdfbox:fontbox@2.0.24 › junit:junit@4.13.2

EPL-1.0 license

EPL-1.0 license vulnerability report