Advisories for Maven/Com.bstek.ureport/Ureport2-Core package

An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.

An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.

ureport v2.2.9 was discovered to contain an arbitrary file deletion vulnerability.

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.