https://github.com/intuit/QuickBooks-V3-Java-SDK/blob/a306e6c9aeb844269dfcad05cd49f0ec68aa062e/ipp-v3-java-devkit/pom.xml#L91 Library `commons-configuration:1.6` use `commons-beanutils-core` which is vulnerable.