Skip to main content
Components
Vulnerabilities
Security Events
Pricing
MCP
API
Docs
Sign up
Login
Find vulnerabilities. Fix fast with AI.
Search components by package, version, or CVE to get started.
com.github.gumtreediff/gumtree-all 2.0.0 |… | Sonatype Guide
Get full component data and automated fixes with Sonatype Guide.
Sign up for free
maven
com.github.gumtreediff
gumtree-all
2.0.0
gumtree-all 2.0.0
Latest
com.github.gumtreediff
Published
Jul 15, 2015
•
Policy
compliance
maven Registry
Developer Trust Score
Recommended Version:
x.y.z
Recommended upgrade that meets your policy.
Compare Versions
Overview
Overview
Versions
1
Versions
1
Vulnerabilities
30
Vulnerabilities
30
Dependencies
12
Dependencies
12
Severity
Critical
(1)
High
(6)
Medium
(22)
Low
(1)
CVSS Score
0.0
10.0
EPSS Score
0.0
1.0
Malware
KEV Status
Published
Filter
Sort: Published (Newest first)
6.9
CVE-2025-48924
Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
affected
Severity
Medium
Published
Jul 14, 2025
6.9
sonatype-2025-000535
github.com/sigstore/sigstore-java (gson) - Stack-based Buffer Overflow [CVE-2025-53864]
affected
Severity
Medium
Published
Feb 13, 2025
5.0
CVE-2023-4218
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
affected
Severity
Medium
Published
Nov 9, 2023
7.1
CVE-2023-2976
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
affected
Severity
High
Published
May 31, 2023
6.1
CVE-2019-11358
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
affected
Severity
Medium
Published
Jul 29, 2022
6.5
CVE-2022-23437
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
affected
Severity
Medium
Published
Jan 25, 2022
7.5
sonatype-2021-1694
gson - Deserialization of Untrusted Data [CVE-2022-25647]
affected
Severity
High
Published
Nov 3, 2021
3.3
sonatype-2020-0926
guava - Creation of Temporary File in Directory with Insecure Permissions [CVE-2020-8908]
affected
Severity
Low
Published
Sep 22, 2020
4.8
sonatype-2014-0257
javassist - IINC Opcode Handling Unspecified Issue
affected
Severity
Medium
Published
Jul 17, 2020
6.1
CVE-2020-11023
EXPLOITED
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
affected
Severity
Medium
Published
Apr 30, 2020
9.8
CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
affected
Severity
Critical
Published
Apr 16, 2020
6.1
sonatype-2020-0187
jQuery - Cross-Site Scripting (XSS) [CVE-2020-11022]
affected
Severity
Medium
Published
Apr 14, 2020
6.1
sonatype-2018-0607
bootstrap - Cross-Site Scripting (XSS)
affected
Severity
Medium
Published
Sep 23, 2019
6.1
sonatype-2017-0695
bootstrap - Cross-Site Scripting (XSS) [CVE-2016-10735]
affected
Severity
Medium
Published
Jul 8, 2019
6.9
sonatype-2018-0590
org.mozilla:rhino - XML External Entity Reference(XXE)
affected
Severity
Medium
Published
Jul 3, 2019
6.1
CVE-2019-8331
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
affected
Severity
Medium
Published
Feb 22, 2019
6.1
CVE-2018-20676
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
affected
Severity
Medium
Published
Jan 14, 2019
6.1
CVE-2018-20677
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
affected
Severity
Medium
Published
Jan 14, 2019
6.1
CVE-2018-14042
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
affected
Severity
Medium
Published
Aug 24, 2018
7.5
CVE-2018-1000632
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
affected
Severity
High
Published
Aug 22, 2018
6.1
CVE-2018-14040
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
affected
Severity
Medium
Published
Jul 31, 2018
5.9
CVE-2018-10237
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
affected
Severity
Medium
Published
Apr 28, 2018
5.3
sonatype-2012-0050
commons-codec - Base32 would decode some invalid Base32 encoded string into arbitrary value
affected
Severity
Medium
Published
Nov 22, 2017
7.5
CVE-2012-0881
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
affected
Severity
High
Published
Nov 2, 2017
5.9
sonatype-2017-0348
sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)
affected
Severity
Medium
Published
Sep 15, 2017
1-25 of 30
