Use of Unmaintained Third Party Components
CWE-1104
The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
We track 20 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9.
Latest Use of Unmaintained Third Party Components vulnerabilities
- 7.5 High severity
HCL Hive: Use of Unmaintained Third Party Components
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.
- 8.5 High severity
HP Easy Start for macOS: Use of Unmaintained Third Party Components
Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Use of Unmaintained Third Party Components
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows
- 8.8 High severity
https://github.com/cloudflare/pages-action: Improper Neutralization of Special Elements used in an OS Command
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitatio
- 9.8 Critical severity
TOML::XS: Use of Unmaintained Third Party Components
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untruste
- 8.8 High severity
Oracle Platform Security for Java: Use of Unmaintained Third Party Components
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged atta
- 9.8 Critical severity
Image::EPEG: Use of Unmaintained Third Party Components
Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.
- 7.8 High severity
Traveler for Microsoft Outlook: Use of Unmaintained Third Party Components
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly know
- 8.3 High severity
BigFix SCM Reporting: Use of Unmaintained Third Party Components
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and
- 8.7 High severity
SicuroWeb (Sicuro24): Use of Unmaintained Third Party Components
Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and
- 7.8 High severity
Intel(R) Processor Identification Utility: Use of Unmaintained Third Party Components
Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low
- 9.8 Critical severity
Print Virtual Appliance Host: Improper Handling of Exceptional Conditions
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client components (PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLaunche
- 9.8 Critical severity
Print Virtual Appliance Host: Use of Unmaintained Third Party Components
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips (released May 2016), which has been end-of-life since 2019
- 9.8 Critical severity
AxxonOne C-Werk: Use of Unmaintained Third Party Components
Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable thi
- 7.1 High severity
ctrlX OS - Setup: Missing Encryption of Sensitive Data
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file its
- 8.7 High severity
iSAP Smart Collector: Use of Unmaintained Third Party Components
The Linux distribution underlying the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) is obsolete and reached end of life (EOL) on June 30, 2024. Thus, any unmitigated vulnerability could be exploited to affect this product.
- 9.8 Critical severity
BSON::XS: Heap-based Buffer Overflow
BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS imp
- 8.8 High severity
Harmony (Formerly Magelis) HMIST6, HMISTM6…: Use of Unmaintained Third Party Components
CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product.
- 8.8 High severity
Sophos Intercept X: Deserialization of Untrusted Data
A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files.
- 9.8 Critical severity
Barracuda ESG Appliance: Use of Unmaintained Third Party Components
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable log