- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 1 high
- Registry
- Maven Central
Advisories 9
- CVE-2022-42890Unrated
Apache Batik prior to 1.16 allows RCE via scripting
Affected: fixed in 1.16.
- CVE-2022-41704High 7.5
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
Affected: fixed in 1.16.
- CVE-2022-40146Unrated
Jar url should be blocked by DefaultScriptSecurity
Affected: from 1.0, fixed in 1.15.
- CVE-2022-38648Unrated
PDFTranscoder does not block external resources
Affected: fixed in 1.15.
- CVE-2022-38398Unrated
Server-Side Request Forgery Information Disclosure Vulnerability
Affected: from 1.14, fixed in 1.15.
- CVE-2019-17566Unrated
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes.
Affected: fixed in 1.13.
- CVE-2018-8013Unrated
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the…
Affected: from 1.0, fixed in 1.10.
- CVE-2017-5662Unrated
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send…
Affected: fixed in 1.9.
- CVE-2015-0250Unrated
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote…
Affected: from 1.0, fixed in 1.8.