Skip to main content
Components
Vulnerabilities
Security Events
Pricing
MCP
API
Docs
Sign up
Login
Find vulnerabilities. Fix fast with AI.
Search components by package, version, or CVE to get started.
uk.ac.open.kmi.iserve/iserve-rest 2.1.1 |… | Sonatype Guide
Get full component data and automated fixes with Sonatype Guide.
Sign up for free
maven
uk.ac.open.kmi.iserve
iserve-rest
2.1.1
iserve-rest 2.1.1
Latest
uk.ac.open.kmi.iserve
Published
Feb 18, 2016
•
Policy
compliance
maven Registry
Developer Trust Score
Recommended Version:
x.y.z
Recommended upgrade that meets your policy.
Compare Versions
Overview
Overview
Versions
6
Versions
6
Vulnerabilities
133
Vulnerabilities
133
Dependencies
23
Dependencies
23
Reset filters
Severity
Critical
(15)
High
(0)
Medium
(0)
Low
(0)
CVSS Score
0.0
10.0
EPSS Score
0.0
1.0
Malware
KEV Status
Published
Filter
Sort: Published (Newest first)
9.1
CVE-2026-75595
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
affected
Severity
Critical
Published
Aug 24, 2026
9.3
sonatype-2020-001837
com.fasterxml.jackson.core/jackson-databind - Deserialization gadget enables RCE via shiro-core JndiObjectFactory
affected
Severity
Critical
Published
Jun 4, 2026
9.8
CVE-2016-4437
EXPLOITED
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
affected
Severity
Critical
Published
Oct 23, 2025
9.8
CVE-2022-40664
Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
affected
Severity
Critical
Published
Oct 13, 2022
9.8
CVE-2022-32532
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
affected
Severity
Critical
Published
Jun 29, 2022
9.8
CVE-2021-41303
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
affected
Severity
Critical
Published
Sep 21, 2021
9.8
CVE-2020-17523
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
affected
Severity
Critical
Published
Feb 4, 2021
9.8
CVE-2020-17510
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
affected
Severity
Critical
Published
Nov 6, 2020
9.8
CVE-2020-1957
Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
affected
Severity
Critical
Published
Apr 23, 2020
9.8
CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
affected
Severity
Critical
Published
Apr 16, 2020
9.8
sonatype-2018-0624
woodstox-core - XML eXternal Entity (XXE)
affected
Severity
Critical
Published
Mar 9, 2020
9.8
CVE-2017-7525
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
affected
Severity
Critical
Published
Aug 17, 2017
9.8
CVE-2017-7503
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
affected
Severity
Critical
Published
Jul 12, 2017
9.8
CVE-2017-5929
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
affected
Severity
Critical
Published
Mar 28, 2017
9.0
sonatype-2015-0002
commons-collections - Arbitrary Remote Code Execution due to Unsafe Deserialization
affected
Severity
Critical
Published
Mar 28, 2017
