Approved changes feed: RSS · Atom
cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Batik (ad02a7e0-45a1-58b5-a954-5f71c2d20fdf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/xmlgraphics |
purl2cpe | 2026-06-01 10:14:28.632594 |
pkg:github/apache/xmlgraphics-batik |
purl2cpe | 2026-06-01 10:14:28.632597 |
pkg:maven/org.apache.xmlgraphics-batik/batik |
purl2cpe | 2026-06-01 10:14:28.632600 |
pkg:rpm/opensuse/xmlgraphics-batik |
purl2cpe | 2026-06-01 10:14:28.632603 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-42890 |
vulnerable | 2026-06-08 05:49:30.651063 |
Apache Batik prior to 1.16 allows RCE via scripting
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Published: 2022-10-25T00:00:00.000Z
Updated: 2024-08-03T13:19:05.216Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41704 |
vulnerable | 2026-06-08 05:48:30.823332 |
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
Published: 2022-10-25T00:00:00.000Z
Updated: 2026-02-25T16:56:27.451Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11987 |
vulnerable | 2026-06-08 05:17:56.015110 |
Details available
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Published: 2021-02-24T00:00:00.000Z
Updated: 2025-11-03T19:25:28.147Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17566 |
vulnerable | 2026-06-08 05:13:10.688732 |
Details available
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Published: 2020-11-12T00:00:00.000Z
Updated: 2024-08-05T01:40:15.834Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8013 |
vulnerable | 2026-06-08 05:12:04.955506 |
Details available
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Published: 2018-05-24T16:00:00.000Z
Updated: 2024-09-16T23:16:36.073Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5662 |
vulnerable | 2026-06-08 05:09:47.798513 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-0250 |
vulnerable | 2026-06-08 05:06:14.138365 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.