CVE:CVE-2016-1000273
JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
solution:Upgrade netty to versions 3.9.6 or higher.
solution:Upgrade com.fasterxml.jackson.core:jackson-core to version 2.7.7 or higher.
solution:Upgrade netty to versions 4.0.45, 4.1.9 or higher.
solution:Avoid using bunto-test_plugin altogether.
solution:Upgrade tinymce to version 4.2.4 or higher.
solution:Upgrade org.json4s:json4s-native to version 4.1.0-M2 or higher.
solution:There is no fixed version for org.webjars.bowergithub.buefy:buefy.
solution:Upgrade org.webjars.bower:angular to version 1.4.0 or higher.
solution:Upgrade org.webjars:qunit to version 2.9.0 or higher.
solution:Upgrade to plotly.js version 1.16.0 or newer.
solution:Upgrade org.webjars.npm:angular to version 1.4.0 or higher.
solution:Upgrade org.webjars.npm:angular to version 1.5.0-beta.0 or higher.
solution:Upgrade org.webjars.npm:rrule to version 2.6.8 or higher.
solution:Upgrade vega to version 2.4.0 or higher.
solution:Upgrade org.webjars.npm:angular to version 1.4.10 or higher.
solution:Upgrade org.webjars.bower:angular to version 1.5.9 or higher.
solution:Upgrade org.webjars.npm:angular to version 1.5.0-rc.0 or higher.
solution:Upgrade org.webjars.npm:angular to version 1.5.0-beta.2 or higher.
solution:Upgrade org.webjars.bower:angular to version 1.5.0-rc.2 or higher.
solution:Upgrade org.webjars.npm:angular to version 1.5.0-rc.2 or higher.
solution:Upgrade org.webjars.bower:angular to version 1.4.10 or higher.
solution:Upgrade com.itextpdf:sign to version 7.1.5 or higher.
solution:Upgrade to plotly.js version 1.16.0 or newer.
solution:Upgrade org.webjars.npm:angular to version 1.2.30 or higher.
solution:Upgrade ag-grid to version 5.0.0 or higher.
solution:There is no fixed version for org.webjars:marked.
solution:There is no fixed version for org.webjars.bowergithub.chjj:marked.
solution:Upgrade org.webjars.npm:marked to version 0.6.2 or higher.
solution:Upgrade tinymce to version 4.2.4 or higher.
solution:Upgrade org.webjars.bowergithub.nodeca:js-yaml to version 3.13.1 or higher.
solution:Upgrade org.apache.httpcomponents:httpclient to version 4.5.3 or higher.
solution:Upgrade Amazon-Linux:2018.03 aws-cfn-bootstrap to version 0:1.4-20.12.amzn1 or higher.This issue was patched in ALAS-2017-866.
solution:Upgrade Amazon-Linux:2018.03 aws-cfn-bootstrap to version 0:1.4-22.14.amzn1 or higher.This issue was patched in ALAS-2017-895.
solution:Upgrade Amazon-Linux:2018.03 aws-cfn-bootstrap to version 0:1.4-21.13.amzn1 or higher.This issue was patched in ALAS-2017-886.
solution:Upgrade org.webjars.bower:angular to version 1.2.30 or higher.
solution:Upgrade org.webjars.npm:marked to version 0.3.9 or higher.
solution:Upgrade org.webjars:handlebars to version 3.0.7, 4.1.2, 4.0.14 or higher.
solution:Upgrade org.webjars.npm:static-eval to version 2.0.2 or higher.
solution:Upgrade org.webjars.bower:summernote to version 0.8.12 or higher.
solution:Upgrade org.webjars.npm:webpack-bundle-analyzer to version 3.3.2 or higher.
solution:Upgrade org.webjars.bower:angular to version 1.5.0-rc.0 or higher.
solution:Upgrade org.apache.hadoop:hadoop-ozone-s3gateway to version 0.4.1-alpha or higher.
solution:Upgrade org.webjars.npm:handlebars to version 3.0.7, 4.1.2, 4.0.14 or higher.
solution:There is no fixed version for org.webjars:reveal.js.
solution:Upgrade org.webjars.bowergithub.hakimel:reveal.js to version 4.0.2 or higher.
solution:There is no fixed version for org.webjars.bower:reveal.js.
solution:There is no fixed version for org.webjars.bower:marked.
solution:There is no fixed version for org.webjars.npm:useragent.
solution:Upgrade org.apache.felix:org.apache.felix.webconsole to version 4.3.12 or higher.
solution:There is no fixed version for org.apache.felix.karaf:karaf.
solution:Upgrade org.webjars.npm:bootstrap-select to version 1.13.6 or higher.
solution:There is no fixed version for org.webjars.bower:jasmine-core.
solution:Upgrade org.webjars.npm:diagram-js to version 6.4.0 or higher.
solution:Upgrade org.webjars.bower:swagger-ui to version 2.2.1 or higher.
solution:There is no fixed version for org.webjars:jquery-colorbox.
solution:Upgrade ractive to version 0.8.0 or higher.
solution:Upgrade crypto-browserify to version 2.1.11 or higher.
solution:Upgrade org.webjars.npm:swagger-ui to version 2.2.8 or higher.
solution:Upgrade vue to version 2.4.3 or higher.
solution:Upgrade org.webjars.npm:angular to version 1.6.7 or higher.
solution:Upgrade org.jenkins-ci.plugins:ontrack to version 3.4.1 or higher.
solution:There is no fixed version for org.webjars.bower:nwmatcher.
solution:Upgrade ua-parser-js to version 0.7.16 or higher.
solution:Upgrade org.primefaces:primefaces to version 6.2 or higher.
solution:There is no fixed version for org.webjars:diff.
solution:Upgrade org.github.evenjn:diff to version 3.5.0 or higher.
solution:Upgrade org.jenkins-ci.plugins:ease-plugin to version 2.2 or higher.
solution:There is no fixed version for org.webjars.bowergithub.jakubpawlowicz:clean-css.
solution:Upgrade mathjs to version 3.11.5 or higher.
solution:There is no fix version for bootstrap-markdown.
solution:Upgrade vue to version 2.4.3 or higher.
solution:Upgrade org.jenkins-ci.plugins:codebeamer-result-trend-updater to version 1.1.4 or higher.
solution:Upgrade com.sksamuel.diff:diff to version 3.5.0 or higher.
solution:Upgrade useragent to version 2.1.13 or higher.
solution:Upgrade org.webjars.npm:clean-css to version 4.1.11 or higher.
solution:Upgrade org.apache.geode:geode-core to version 1.4.0 or higher.
solution:Upgrade js-quantities to version 1.6.4 or higher.
solution:Upgrade tunnel-agent to version 0.6.0 or higher.
Note This is vulnerable only for Node &lt;=4
solution:There is no fix version for utile.
solution:There is no fixed version for org.webjars.bowergithub.chjj:marked.
solution:Upgrade org.webjars.bowergithub.markedjs:marked to version 0.4.0 or higher.
solution:Upgrade com.fasterxml.jackson.core:jackson-core to version 2.8.6 or higher.
solution:Upgrade org.webjars:swagger-ui to version 3.18.1 or higher.
solution:There is no fixed version for org.webjars.npm:angucomplete-alt.
solution:There is no fixed version for org.webjars.bower:js-quantities.
solution:Upgrade mysql to version 2.14.0 or higher.
Note This is vulnerable only for Node &lt;=4
solution:Upgrade org.webjars.bower:angular to version 1.5.0-beta.2 or higher.
solution:Upgrade vue to version 2.3.0-beta.1 or higher.
solution:There is no fixed version for org.webjars.bower:angucomplete-alt.
solution:Upgrade org.webjars.npm:angular to version 1.5.9 or higher.
solution:There is no fixed version for org.webjars.bower:js-yaml.
solution:Update vue to version 2.5.14 or higher.
solution:Upgrade xlsx to verson 0.12.2 or higher
solution:Upgrade org.webjars.bower:swagger-ui to version 3.18.0 or higher.
solution:Update node-forge to version 0.7.4 or higher.
solution:Upgrade org.webjars.npm:eslint to version 4.18.2 or higher.
solution:There is no fixed version for org.webjars.npm:ngx-bootstrap.
solution:Update vue to version 2.5.14 or higher.
solution:Update vue to version 2.5.14 or higher.
solution:Update vue to version 2.5.14 or higher.
solution:Upgrade org.webjars.npm:swagger-ui to version 3.0.14 or higher.
solution:There is no fixed version for com.cloudcoreo.plugins:cloudcoreo-deploytime.
solution:Upgrade org.webjars.npm:swagger-ui to version 3.18.1 or higher.
solution:Upgrade encryptor to version 3.0.0 or higher.
solution:Upgrade activeadmin to version 0.1.0 or higher.
solution:Avoid using active-explorer altogether.
solution:Avoid using ar-lightning altogether.
solution:Avoid using arproxy-plugin-mysql-casual_log altogether.
solution:Avoid using ardm_sqlite-adapter altogether.
solution:Avoid using active-merchant_mollie altogether.
solution:Avoid using ardm_serializer altogether.
solution:Avoid using telegram-bot_api altogether.
solution:Avoid using royal-mail_scraper altogether.
solution:Avoid using seeing-is_believing altogether.
solution:Avoid using ruby-playing_cards altogether.
solution:Avoid using telegram-bot_ruby altogether.
solution:Avoid using 99designs_tasks altogether.
solution:Avoid using 1-as-identity_function altogether.
solution:Avoid using addy-caddy_client altogether.
solution:Avoid using omniauth_amazon altogether.
solution:Avoid using apress_validators altogether.
solution:Upgrade redis-namespace to version 1.0.4, 1.1.1, 1.2.2, 1.3.1 or higher.
solution:Avoid using blockchain_wallet altogether.
solution:Upgrade jquery_mobile_rails to version 1.2.0 or higher.
solution:Upgrade puma to version 2.9.2 or higher.
solution:Avoid using alipay-dualfun altogether.
solution:Upgrade shipit-engine to version 0.12.0 or later
solution:Avoid using alphabetical-paginate altogether.
solution:Avoid using aliyun_push altogether.
solution:Avoid using alerty_plugin-mail altogether.
solution:Avoid using aligned-table altogether.
solution:There is no fixed version for ecdsa.
solution:Avoid using coin_base altogether.
solution:Upgrade rails_autolink to version 1.1.6 or higher.
solution:Upgrade jekyll to version 1.0.0 or higher.
solution:Avoid using alipay-global altogether.
solution:Avoid using api-deploy altogether.
solution:Avoid using abstract-api_wrapper altogether.
solution:Avoid using asset-symlink altogether.
solution:Avoid using application-insights altogether.
solution:Avoid using at_validations altogether.
solution:Avoid using alephant_publisher-request altogether.
solution:Avoid using bosh-cli_plugin_redis altogether.
solution:Avoid using attr-searchable altogether.
solution:Avoid using capistrano3_drupal altogether.
solution:Avoid using assembly_client altogether.
solution:Avoid using activerecord_postgresql-expression altogether.
solution:Avoid using claide_plugins altogether.
solution:Avoid using acts-as_journalized altogether.
solution:Avoid using activerecord_jdbcsplice-adapter altogether.
solution:Avoid using cinch_logsearch altogether.
solution:Avoid using lita_onewheel-beer-btu altogether.
solution:Avoid using commission-junction_stats altogether.
solution:Avoid using cinch_weatherman altogether.
solution:Avoid using assemblyline_ruby altogether.
solution:Avoid using contributors-stats altogether.
solution:Avoid using ceedling_autorake altogether.
solution:Avoid using lita_onewheel-beer-wayfinder altogether.
solution:Avoid using moving-images altogether.
solution:Avoid using lita_onewheel-beer-wework altogether.
solution:Avoid using cocoapods_fixbugs-plugin altogether.
solution:Avoid using moving-average altogether.
solution:Avoid using cap_drupal-multisite altogether.
solution:Avoid using chef_cloudsearch altogether.
solution:Avoid using apple-dep_client altogether.
solution:Avoid using get-stats altogether.
solution:Avoid using ali-mns altogether.
solution:Avoid using assets_publisher-for-hanami altogether.
solution:Avoid using lita_onewheel-beer-craftpourhouse altogether.
solution:Avoid using ae-validates-timeliness altogether.
solution:Avoid using acts-as_keywordable altogether.
solution:Avoid using ackintosh-net-empty-port altogether.
solution:Upgrade json-jwt to version 0.6.1 or higher.
solution:Avoid using http-statsd altogether.
solution:Avoid using asterisk_ari-client altogether.