Apache Uimaducc vulnerabilities

2 known vulnerabilities affecting apache/uimaducc.

Total CVEs

2

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

MEDIUM2

Vulnerabilities

Page 1 of 1

CVE-2018-8035MEDIUMCVSS 6.1≤ 2.2.22019-05-01

CVE-2018-8035 [MEDIUM] CWE-79 CVE-2018-8035: This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascrip This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.

CVE-2017-15691MEDIUMCVSS 6.5fixed in 2.2.22018-04-26

CVE-2017-15691 [MEDIUM] CWE-611 CVE-2017-15691: In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various s