Components Vulnerabilities Pricing MCP API

net.ontopia/webapp-accessctl 5.6.0 | Vulne… | Sonatype Guide

webapp-accessctl

5.6.0

webapp-accessctl 5.6.0

Latest

net.ontopia

PublishedAug 20, 2025•Policy

compliance

Developer Trust Score

N/A

Recommended Version:x.y.z

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

Severity

Critical (0)

High (8)

Medium (0)

Low (0)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV StatusPublished

8.7sonatype-2024-3350

commons-collections - Uncontrolled Recursion

PublishedAug 13, 2024

8.7sonatype-2023-4396

commons-io - REDOS

PublishedOct 11, 2023

8.6sonatype-2023-2736

reload4j - XML External Entity (XXE) Injection

PublishedJun 23, 2023

7.5CVE-2023-26464

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

8.6sonatype-2022-5401

reload4j - XML eXternal Entity (XXE)

PublishedSep 5, 2022

8.8CVE-2022-23307

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

7.5CVE-2021-4104

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

7.5CVE-2015-0254

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

PublishedMar 28, 2017

PublishedMar 13, 2023

Published

Jan 20, 2022

PublishedDec 14, 2021