Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.xwiki.commons:xwiki-commons-velocity

2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
2 · 1 critical, 1 high
Registry
Maven Central

Advisories 2

  • CVE-2024-31996Critical 10.0

    XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

    Affected: from 3.0.1, fixed in 14.10.19; from 15.0-rc-1, fixed in 15.5.4; from 15.6-rc-1, fixed in 15.9-rc-1.

  • Arbitrary filesystem write access from Velocity

    Affected: from 2.3.0, fixed in 12.6.7; from 12.7.0, fixed in 12.10.3.