Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/199233?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/199233?format=api", "purl": "pkg:maven/org.glassfish/javax.faces@2.1.20-13", "type": "maven", "namespace": "org.glassfish", "name": "javax.faces", "version": "2.1.20-13", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.3.7", "latest_non_vulnerable_version": "2.3.7", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51875?format=api", "vulnerability_id": "VCID-16cm-kc5a-cyfb", "summary": "Cross-site Scripting\n`faces/context/PartialViewContextImpl.java` allows Reflected XSS because a client window field is mishandled.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-17091", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.05622", "scoring_system": "epss", "scoring_elements": "0.90511", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.05622", "scoring_system": "epss", "scoring_elements": "0.90514", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.05622", "scoring_system": "epss", "scoring_elements": "0.90513", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.05622", "scoring_system": "epss", "scoring_elements": "0.90498", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-17091" }, { "reference_url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/issues/4556", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/issues/4556" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/pull/4567", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/pull/4567" }, { "reference_url": "https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17091", "reference_id": "CVE-2019-17091", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17091" }, { "reference_url": "https://github.com/advisories/GHSA-rjhx-c9qh-qh8f", "reference_id": "GHSA-rjhx-c9qh-qh8f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rjhx-c9qh-qh8f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/155554?format=api", "purl": "pkg:maven/org.glassfish/javax.faces@2.2.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-aaf4-w9f8-6bhp" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.glassfish/javax.faces@2.2.20" } ], "aliases": [ "CVE-2019-17091", "GHSA-rjhx-c9qh-qh8f" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-16cm-kc5a-cyfb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37726?format=api", "vulnerability_id": "VCID-5xv3-mdjm-g3f8", "summary": "XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions\nThis package does not perform appropriate encoding when a `<h:outputText>` tag or EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.", "references": [ { "reference_url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/ba-p/6368011#.U8ccVPlXZHU", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/ba-p/6368011#.U8ccVPlXZHU" }, { "reference_url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209", "reference_id": "", "reference_type": "", "scores": [], "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-5855.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-5855.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-5855", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02316", "scoring_system": "epss", "scoring_elements": "0.85103", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.02316", "scoring_system": "epss", "scoring_elements": "0.85108", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.02316", "scoring_system": "epss", "scoring_elements": "0.85104", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.02316", "scoring_system": "epss", "scoring_elements": "0.8508", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-5855" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5855", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5855" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5855", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5855" }, { "reference_url": "http://seclists.org/fulldisclosure/2014/Dec/23", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2014/Dec/23" }, { "reference_url": "https://java.net/jira/browse/JAVASERVERFACES-3150", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://java.net/jira/browse/JAVASERVERFACES-3150" }, { "reference_url": "https://java.net/jira/browse/JAVASERVERFACES_SPEC_PUBLIC-1258", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://java.net/jira/browse/JAVASERVERFACES_SPEC_PUBLIC-1258" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html" }, { "reference_url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139", "reference_id": "1065139", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740586", "reference_id": "740586", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740586" }, { "reference_url": "https://github.com/advisories/GHSA-3m3r-82gc-53mj", "reference_id": "GHSA-3m3r-82gc-53mj", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3m3r-82gc-53mj" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2014:0896", "reference_id": "RHSA-2014:0896", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2014:0896" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2014:0910", "reference_id": "RHSA-2014:0910", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2014:0910" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:0234", "reference_id": "RHSA-2015:0234", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:0234" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:0235", "reference_id": "RHSA-2015:0235", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:0235" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:0675", "reference_id": "RHSA-2015:0675", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:0675" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:0720", "reference_id": "RHSA-2015:0720", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:0720" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:0765", "reference_id": "RHSA-2015:0765", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:0765" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:1009", "reference_id": "RHSA-2015:1009", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:1009" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/150726?format=api", "purl": "pkg:maven/org.glassfish/javax.faces@2.1.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-16cm-kc5a-cyfb" }, { "vulnerability": "VCID-5xv3-mdjm-g3f8" }, { "vulnerability": "VCID-aaf4-w9f8-6bhp" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.glassfish/javax.faces@2.1.28" }, { "url": "http://public2.vulnerablecode.io/api/packages/51927?format=api", "purl": "pkg:maven/org.glassfish/javax.faces@2.2.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-16cm-kc5a-cyfb" }, { "vulnerability": "VCID-aaf4-w9f8-6bhp" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.glassfish/javax.faces@2.2.6" } ], "aliases": [ "CVE-2013-5855", "GHSA-3m3r-82gc-53mj" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5xv3-mdjm-g3f8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40100?format=api", "vulnerability_id": "VCID-aaf4-w9f8-6bhp", "summary": "The `getLocalePrefix` function in `ResourceManager` contains a Path Traversal vulnerability.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14371.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14371.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-14371", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01625", "scoring_system": "epss", "scoring_elements": "0.822", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.01625", "scoring_system": "epss", "scoring_elements": "0.8223", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.01625", "scoring_system": "epss", "scoring_elements": "0.82229", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.01625", "scoring_system": "epss", "scoring_elements": "0.82228", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-14371" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24" }, { "reference_url": "https://github.com/eclipse-ee4j/mojarra/pull/4384", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/eclipse-ee4j/mojarra/pull/4384" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607709", "reference_id": "1607709", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607709" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14371", "reference_id": "CVE-2018-14371", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14371" }, { "reference_url": "https://github.com/advisories/GHSA-43q7-q5vp-3g68", "reference_id": "GHSA-43q7-q5vp-3g68", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-43q7-q5vp-3g68" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2062", "reference_id": "RHSA-2020:2062", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2062" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2063", "reference_id": "RHSA-2020:2063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2113", "reference_id": "RHSA-2020:2113", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2113" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2511", "reference_id": "RHSA-2020:2511", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2511" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2512", "reference_id": "RHSA-2020:2512", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2512" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2513", "reference_id": "RHSA-2020:2513", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2513" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2515", "reference_id": "RHSA-2020:2515", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2515" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3585", "reference_id": "RHSA-2020:3585", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3585" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/63262?format=api", "purl": "pkg:maven/org.glassfish/javax.faces@2.3.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.glassfish/javax.faces@2.3.7" } ], "aliases": [ "CVE-2018-14371", "GHSA-43q7-q5vp-3g68" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-aaf4-w9f8-6bhp" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.glassfish/javax.faces@2.1.20-13" }