Skip to content

Conversation

@Dobridp
Copy link

@Dobridp Dobridp commented Mar 27, 2025

snyk-top-banner

Snyk has created this PR to upgrade org.hibernate:hibernate-core from 4.0.1.Final to 4.3.11.Final.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 60 versions ahead of your current version.

  • The recommended version was released 10 years ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
critical severity Deserialization of Untrusted Data
SNYK-JAVA-COMMONSCOLLECTIONS-30078
625 Mature
medium severity Deserialization of Untrusted Data
SNYK-JAVA-COMMONSCOLLECTIONS-472711
625 Proof of Concept
critical severity Deserialization of Untrusted Data
SNYK-JAVA-COMMONSCOLLECTIONS-6056408
625 Mature

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

…Final

Snyk has created this PR to upgrade org.hibernate:hibernate-core from 4.0.1.Final to 4.3.11.Final.

See this package in maven:
org.hibernate:hibernate-core

See this project in Snyk:
https://app.us.snyk.io/org/nova8-techsales-team/project/d209c361-daeb-47df-82df-32e139c70421?utm_source=github&utm_medium=referral&page=upgrade-pr
@msant262
Copy link

Logo
Checkmarx One – Scan Summary & Detailsc522fedc-e23e-473d-984f-f65d5859ff6b

New Issues (139)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL SQL_Injection /src/main/webapp/vulnerability/DisplayMessage.jsp: 16
detailsThe application's method executes an SQL query with executeQuery, at line 16 of /src/main/webapp/vulnerability/DisplayMessage.jsp. The application...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/ForgotPassword.jsp: 42
detailsThe application's method executes an SQL query with executeQuery, at line 42 of /src/main/webapp/ForgotPassword.jsp. The application constructs th...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/ForgotPassword.jsp: 42
detailsThe application's method executes an SQL query with executeQuery, at line 42 of /src/main/webapp/ForgotPassword.jsp. The application constructs th...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/forumposts.jsp: 9
detailsThe application's method executes an SQL query with executeQuery, at line 14 of /src/main/webapp/vulnerability/forumposts.jsp. The application con...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/admin/adminlogin.jsp: 11
detailsThe application's method executes an SQL query with executeQuery, at line 19 of /src/main/webapp/admin/adminlogin.jsp. The application constructs ...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/admin/manageusers.jsp: 13
detailsThe application's method executes an SQL query with executeUpdate, at line 14 of /src/main/webapp/admin/manageusers.jsp. The application construct...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/idor/change-email.jsp: 28
detailsThe application's method executes an SQL query with executeUpdate, at line 32 of /src/main/webapp/vulnerability/idor/change-email.jsp. The applica...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/forum.jsp: 41
detailsThe application's method executes an SQL query with executeUpdate, at line 48 of /src/main/webapp/vulnerability/forum.jsp. The application constru...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/forum.jsp: 42
detailsThe application's method executes an SQL query with executeUpdate, at line 48 of /src/main/webapp/vulnerability/forum.jsp. The application constru...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/forum.jsp: 43
detailsThe application's method executes an SQL query with executeUpdate, at line 48 of /src/main/webapp/vulnerability/forum.jsp. The application constru...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/UserDetails.jsp: 8
detailsThe application's method executes an SQL query with executeQuery, at line 13 of /src/main/webapp/vulnerability/UserDetails.jsp. The application co...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/myprofile.jsp: 16
detailsThe application's method executes an SQL query with executeQuery, at line 21 of /src/main/webapp/myprofile.jsp. The application constructs this SQ...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/myprofile.jsp: 16
detailsThe application's method executes an SQL query with executeQuery, at line 29 of /src/main/webapp/myprofile.jsp. The application constructs this SQ...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/sqli/download_id.jsp: 18
detailsThe application's method executes an SQL query with executeQuery, at line 24 of /src/main/webapp/vulnerability/sqli/download_id.jsp. The applicati...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/sqli/download_id_union.jsp: 18
detailsThe application's method executes an SQL query with executeQuery, at line 24 of /src/main/webapp/vulnerability/sqli/download_id_union.jsp. The app...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/csrf/change-info.jsp: 26
detailsThe application's method executes an SQL query with executeUpdate, at line 31 of /src/main/webapp/vulnerability/csrf/change-info.jsp. The applicat...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/idor/change-email.jsp: 27
detailsThe application's method executes an SQL query with executeUpdate, at line 32 of /src/main/webapp/vulnerability/idor/change-email.jsp. The applica...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/changeCardDetails.jsp: 37
detailsThe application's method executes an SQL query with executeUpdate, at line 43 of /src/main/webapp/changeCardDetails.jsp. The application construct...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/changeCardDetails.jsp: 38
detailsThe application's method executes an SQL query with executeUpdate, at line 43 of /src/main/webapp/changeCardDetails.jsp. The application construct...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/changeCardDetails.jsp: 39
detailsThe application's method executes an SQL query with executeUpdate, at line 43 of /src/main/webapp/changeCardDetails.jsp. The application construct...
Attack Vector
CRITICAL SQL_Injection /src/main/webapp/vulnerability/csrf/changepassword.jsp: 33
detailsThe application's method executes an SQL query with executeUpdate, at line 40 of /src/main/webapp/vulnerability/csrf/changepassword.jsp. The appli...
Attack Vector
CRITICAL SQL_Injection /src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java: 35
detailsThe application's method executes an SQL query with executeQuery, at line 14 of /src/main/webapp/vulnerability/Messages.jsp. The application const...
Attack Vector
CRITICAL SQL_Injection /src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java: 36
detailsThe application's method executes an SQL query with executeQuery, at line 14 of /src/main/webapp/vulnerability/Messages.jsp. The application const...
Attack Vector
CRITICAL Second_Order_SQL_Injection /src/main/webapp/admin/adminlogin.jsp: 19
detailsThe application's method executes an SQL query with BinaryExpr, at line 40 of /src/main/webapp/vulnerability/csrf/changepassword.jsp. The applicat...
Attack Vector
CRITICAL Second_Order_SQL_Injection /src/main/webapp/admin/adminlogin.jsp: 19
detailsThe application's method executes an SQL query with BinaryExpr, at line 31 of /src/main/webapp/vulnerability/csrf/change-info.jsp. The application...
Attack Vector
CRITICAL Second_Order_SQL_Injection /src/main/webapp/admin/adminlogin.jsp: 19
detailsThe application's method executes an SQL query with BinaryExpr, at line 43 of /src/main/webapp/changeCardDetails.jsp. The application constructs t...
Attack Vector
CRITICAL Second_Order_SQL_Injection /src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java: 52
detailsThe application's method executes an SQL query with BinaryExpr, at line 14 of /src/main/webapp/vulnerability/Messages.jsp. The application constru...
Attack Vector
CRITICAL Second_Order_SQL_Injection /src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java: 52
detailsThe application's method executes an SQL query with BinaryExpr, at line 40 of /src/main/webapp/vulnerability/csrf/changepassword.jsp. The applicat...
Attack Vector
CRITICAL Second_Order_SQL_Injection /src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java: 52
detailsThe application's method executes an SQL query with BinaryExpr, at line 31 of /src/main/webapp/vulnerability/csrf/change-info.jsp. The application...
Attack Vector
CRITICAL Second_Order_SQL_Injection /src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java: 52
detailsThe application's method executes an SQL query with BinaryExpr, at line 43 of /src/main/webapp/changeCardDetails.jsp. The application constructs t...
Attack Vector
CRITICAL Stored_XSS /src/main/webapp/vulnerability/forumUsersList.jsp: 12
detailsThe method embeds untrusted data in generated output with print, at line 18 of /src/main/webapp/vulnerability/forumUsersList.jsp. This untrusted d...
Attack Vector
CRITICAL Stored_XSS /src/main/webapp/vulnerability/forumposts.jsp: 14
detailsThe method embeds untrusted data in generated output with print, at line 17 of /src/main/webapp/vulnerability/forumposts.jsp. This untrusted data ...
Attack Vector
CRITICAL Stored_XSS /src/main/webapp/vulnerability/forumposts.jsp: 14
detailsThe method embeds untrusted data in generated output with print, at line 18 of /src/main/webapp/vulnerability/forumposts.jsp. This untrusted data ...
Attack Vector
CRITICAL Stored_XSS /src/main/webapp/vulnerability/forumposts.jsp: 14
detailsThe method embeds untrusted data in generated output with print, at line 19 of /src/main/webapp/vulnerability/forumposts.jsp. This untrusted data ...
Attack Vector
CRITICAL Stored_XSS /src/main/webapp/vulnerability/Messages.jsp: 14
detailsThe method embeds untrusted data in generated output with print, at line 19 of /src/main/webapp/vulnerability/Messages.jsp. This untrusted data is...
Attack Vector
CRITICAL Stored_XSS /src/main/webapp/vulnerability/DisplayMessage.jsp: 16
detailsThe method embeds untrusted data in generated output with print, at line 19 of /src/main/webapp/vulnerability/DisplayMessage.jsp. This untrusted d...
Attack Vector

More results are available on the CxOne platform

Fixed Issues (23)
Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
CRITICAL CVE-2015-4852 Maven-commons-collections:commons-collections-3.2.1
CRITICAL CVE-2015-7501 Maven-commons-collections:commons-collections-3.2.1
CRITICAL CVE-2016-2170 Maven-commons-collections:commons-collections-3.2.1
HIGH CVE-2015-6420 Maven-commons-collections:commons-collections-3.2.1
HIGH Cx78f40514-81ff Maven-commons-collections:commons-collections-3.2.1
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/poc2/analitc.js: 25
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/xss.js: 25
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/policy.js: 25
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/test2.js: 25
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/poc2/xss.js: 25
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/PocXSS.js: 25
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/policy2.js: 25
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/poc2/xss.js: 9
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/PocXSS.js: 9
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/policy2.js: 9
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/poc2/analitc.js: 9
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/xss.js: 9
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/policy.js: 9
HIGH Reflected_XSS /src/main/java/org/cysecurity/cspf/jvl/model/orm/test2.js: 9
MEDIUM Missing_HSTS_Header /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/poc2/analitc.js: 19
MEDIUM Missing_HSTS_Header /src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java: 55
LOW Heap_Inspection /src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 33
LOW Missing_CSP_Header /src/main/java/org/cysecurity/cspf/jvl/model/orm/poc/poc2/analitc.js: 19

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants