Login Request a demo
BA
Product
Batik
by Apache · last CVE Oct 25, 2022
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 1High 6Medium 2Low 0
Severity
All severities10Critical1High6Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Batik to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-8013
9.8
19%
May 24
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the…
Affected: 1.0 before 1.10
CVE-2020-11987
8.2
13%
Feb 24
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel
Affected: through 1.13
CVE-2022-41704
7.5
3%
Oct 25
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
Affected: 1.0 before 1.16
CVE-2022-42890
7.5
3%
Oct 25
Apache Batik prior to 1.16 allows RCE via scripting
Affected: 1.0 before 1.16
CVE-2022-40146
7.5
7%
Sep 22
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url
Affected: 1.14
CVE-2019-17566
7.5
11%
Nov 12
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes
Affected: before 1.13
CVE-2017-5662
7.3
4%
Apr 18
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files
Affected: through 1.8
CVE-2022-38648
5.3
2%
Sep 22
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources
Affected: 1.14
CVE-2022-38398
5.3
3%
Sep 22
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol
Affected: 1.14
CVE-2015-0250
–
17%
Mar 24
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or…
Affected: through 1.7
Showing 10