Batik (Apache) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 31 known versions, newest CVE from 2022-10-25. Vendor: Apache.
CVEs of Batik
- CVE-2022-41704 - CVSS 7.5 (high), 2022-10-25: A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to…
- CVE-2022-42890 - CVSS 7.5 (high), 2022-10-25: A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics…
- CVE-2022-38398 - CVSS 5.3 (medium), 2022-09-22: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects…
- CVE-2022-40146 - CVSS 7.5 (high), 2022-09-22: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache…
- CVE-2022-38648 - CVSS 5.3 (medium), 2022-09-22: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML…
- CVE-2020-11987 - CVSS 8.2 (high), 2021-02-24: Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted…
- CVE-2019-17566 - CVSS 7.5 (high), 2020-11-12: Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted…
- CVE-2018-8013 - CVSS 9.8 (critical), 2018-05-24: In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then…
- CVE-2017-5662 - CVSS 7.3 (high), 2017-04-18: In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG…
- CVE-2015-0250 - CVSS 6.4 (medium), 2015-03-24: XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read…
