What denotes 'Vulnerabilities' section from 'https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload/1.4' page?

Question

Here I need to search latest version of dependency which is not vulnerable but as I navigate to maven repository page https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload/1.4 , I see there is also vulnerabilities written under 'Vulnerabilities' section. I am in dilemma, whether this indicates a resolved vulnerability for given version or persisted still. Please clear whether this version is vulnerable or not?

<!-- https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload -->
<dependency>
    <groupId>commons-fileupload</groupId>
    <artifactId>commons-fileupload</artifactId>
    <version>1.4</version>
</dependency>

Snapshot-->

Answer 1

Issue was reported in commons-fileupload FILEUPLOAD-347

There are two vulnerabilities from dependencies:

• one on junit - it is not propagated to end user
• second - it's depends if commons-fileupload use method FileNameUtils.normalize from commons-io - to check in source code

The best way is follow and / or ask such question in project tracking issue.