# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Apache Zeppelin: LDAP search filter query Injection Vulnerability](https://agentprime.io/advisories/GHSA-qmr3-52xf-wmhx.md)
  `GHSA-qmr3-52xf-wmhx`, `CVE-2024-31867` · Maven `org.apache.zeppelin:zeppelin-server`: affected `>=0.8.2, <0.11.1`, fixed in `0.11.1` · CVSS 5.9 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Other injection, CWE-20
- [Apache Zeppelin vulnerable to cross-site scripting in the helium module](https://agentprime.io/advisories/GHSA-rrvf-5w4r-3x7v.md)
  `GHSA-rrvf-5w4r-3x7v`, `CVE-2024-31868` · Maven `org.apache.zeppelin:zeppelin-interpreter`: affected `>=0.8.2, <0.11.1`, fixed in `0.11.1` · CVSS 6.1 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Cross-site scripting (XSS), CWE-116
- [Apache Zeppelin: Cron arbitrary user impersonation with improper privileges](https://agentprime.io/advisories/GHSA-g44m-x5h7-fr5q.md)
  `GHSA-g44m-x5h7-fr5q`, `CVE-2024-31865` · Maven `org.apache.zeppelin:zeppelin-server`: affected `>=0.8.2, <0.11.1`, fixed in `0.11.1` · CVSS 5.4 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Broken access control, CWE-20
- [Improper escaping in Apache Zeppelin](https://agentprime.io/advisories/GHSA-86jx-wr74-xr74.md)
  `GHSA-86jx-wr74-xr74`, `CVE-2024-31866` · Maven `org.apache.zeppelin:zeppelin-interpreter`: affected `>=0.8.2, <0.11.1`, fixed in `0.11.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-116
- [Apache Zeppelin remote code execution by adding malicious JDBC connection string](https://agentprime.io/advisories/GHSA-66j8-c83m-gj5f.md)
  `GHSA-66j8-c83m-gj5f`, `CVE-2024-31864` · Maven `org.apache.zeppelin:zeppelin-jdbc`: affected `<0.11.1`, fixed in `0.11.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2024 · Tags: Code injection
- [google-oauth-java-client improperly verifies cryptographic signature](https://agentprime.io/advisories/GHSA-hw42-3568-wj87.md)
  `GHSA-hw42-3568-wj87`, `CVE-2021-22573` · Maven `com.google.oauth-client:google-oauth-client`: affected `>=1.16.0-rc, <1.33.3`, fixed in `1.33.3` · CVSS 8.7 High · Not analysed yet · Published 9 Apr 2024 · Tags: Weak cryptography or TLS
- [Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE](https://agentprime.io/advisories/GHSA-rr59-h6rh-v84v.md)
  `GHSA-rr59-h6rh-v84v`, `CVE-2022-47894` · Maven `org.apache.zeppelin:sap`: affected `>=0.8.0, <0.11.0`, fixed in `0.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: XML external entities (XXE), CWE-20
- [Apache Zeppelin: Replacing other users notebook, bypassing any permissions](https://agentprime.io/advisories/GHSA-m65c-wmw9-vmpp.md)
  `GHSA-m65c-wmw9-vmpp`, `CVE-2024-31863` · Maven `org.apache.zeppelin:zeppelin-server`: affected `>=0.10.1, <0.11.0`, fixed in `0.11.0` · CVSS 6.5 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Authentication bypass
- [Eclipse Kura LogServlet vulnerability](https://agentprime.io/advisories/GHSA-frc2-w2cc-x794.md)
  `GHSA-frc2-w2cc-x794`, `CVE-2024-3046` · Maven `org.eclipse.kura:org.eclipse.kura.web2`: affected `>=2.0.600, <=2.4.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2024 · Tags: Authentication bypass
- [Apache Zeppelin: Denial of service with invalid notebook name](https://agentprime.io/advisories/GHSA-6623-c6mr-6737.md)
  `GHSA-6623-c6mr-6737`, `CVE-2024-31862` · Maven `org.apache.zeppelin:zeppelin-server`: affected `>=0.10.1, <0.11.0`, fixed in `0.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-20
- [Apache Zeppelin CSRF vulnerability in the Credentials page](https://agentprime.io/advisories/GHSA-prvg-rh5h-74jr.md)
  `GHSA-prvg-rh5h-74jr`, `CVE-2021-28656` · Maven `org.apache.zeppelin:zeppelin-web`: affected `<=0.9.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Cross-site request forgery (CSRF)
- [Apache Zeppelin Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-g64r-xf39-q4p5.md)
  `GHSA-g64r-xf39-q4p5`, `CVE-2024-31860` · Maven `org.apache.zeppelin:zeppelin-server`: affected `>=0.9.0, <0.11.0`, fixed in `0.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Path traversal, CWE-20
- [WildFly Elytron: SSRF security issue](https://agentprime.io/advisories/GHSA-v4mm-q8fv-r2w5.md)
  `GHSA-v4mm-q8fv-r2w5`, `CVE-2024-1233` · Maven `org.wildfly.security:wildfly-elytron-realm-token`: affected `<=2.4.0.CR1`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 9 Apr 2024 · Tags: Server-side request forgery (SSRF)
- [Xuxueli xxl-job template injection vulnerability](https://agentprime.io/advisories/GHSA-2v42-xp3j-47m4.md)
  `GHSA-2v42-xp3j-47m4`, `CVE-2024-3366` · Maven `com.xuxueli:xxl-job-core`: affected `<=2.4.0`, no fixed version yet · CVSS 3.5 Low · Not analysed yet · Published 6 Apr 2024 · Tags: Other injection, Insecure deserialization
- [quarkus-core leaks local environment variables from Quarkus namespace during application's build](https://agentprime.io/advisories/GHSA-f8h5-v2vg-46rr.md)
  `GHSA-f8h5-v2vg-46rr`, `CVE-2024-2700` · Maven `io.quarkus:quarkus-core`: affected `>=3.9.0.CR1, <3.9.2 || >=3.3.0.CR1, <3.8.4 || <3.2.12.Final`, fixed in `3.9.2`, `3.8.4`, `3.2.12.Final` · CVSS 7.0 High · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-526
- [Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints](https://agentprime.io/advisories/GHSA-7mg2-6c6v-342r.md)
  `GHSA-7mg2-6c6v-342r`, `CVE-2024-29834` · Maven `org.apache.pulsar:pulsar-broker`: affected `>=2.7.1, <=2.10.6 || >=2.11.0, <=2.11.4 || >=3.0.0, <3.0.4 || >=3.1.0, <=3.1.3 || >=3.2.0, <3.2.2`, fixed in `3.0.4`, `3.2.2` · CVSS 6.4 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Broken access control
- [Eclipse Vert.x vulnerable to a memory leak in TCP servers](https://agentprime.io/advisories/GHSA-9ph3-v2vh-3qx7.md)
  `GHSA-9ph3-v2vh-3qx7`, `CVE-2024-1300` · Maven `io.vertx:vertx-core`: affected `>=4.3.4, <4.4.8 || >=4.5.0, <4.5.3`, fixed in `4.4.8`, `4.5.3` · CVSS 5.4 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Denial of service
- [Withdrawn: JJWT improperly generates signing keys](https://agentprime.io/advisories/GHSA-r65j-6h5f-4f92.md)
  `GHSA-r65j-6h5f-4f92`, `CVE-2024-31033` · Maven `io.jsonwebtoken:jjwt-impl`: affected `<=0.12.5`, no fixed version yet · CVSS 6.8 Medium · Withdrawn · Not analysed yet · Published 1 Apr 2024 · Tags: Weak cryptography or TLS
- [Bonita cross-site scripting vulnerability](https://agentprime.io/advisories/GHSA-8vj9-5v5q-fhch.md)
  `GHSA-8vj9-5v5q-fhch`, `CVE-2024-27609` · Maven `org.bonitasoft.console:bonita-web-server` and 1 more: affected `<10.1.0.W11`, fixed in `10.1.0.W11` · CVSS 6.1 Medium · Not analysed yet · Published 1 Apr 2024 · Tags: Cross-site scripting (XSS)
- [Elasticsearch Uncaught Exception leading to crash](https://agentprime.io/advisories/GHSA-pw39-f3m5-cxfc.md)
  `GHSA-pw39-f3m5-cxfc`, `BIT-elasticsearch-2024-23449`, `CVE-2024-23449` · Maven `org.elasticsearch:elasticsearch`: affected `>=8.4.0, <8.11.1`, fixed in `8.11.1` · CVSS 4.3 Medium · Not analysed yet · Published 29 Mar 2024 · Tags: CWE-248
- [Elasticsearch Incorrect Authorization vulnerability](https://agentprime.io/advisories/GHSA-r3hx-qfh5-r9m7.md)
  `GHSA-r3hx-qfh5-r9m7`, `BIT-elasticsearch-2024-23451`, `CVE-2024-23451` · Maven `org.elasticsearch:elasticsearch`: affected `>=8.10.0, <8.13.0`, fixed in `8.13.0` · CVSS 4.4 Medium · Not analysed yet · Published 27 Mar 2024 · Tags: Broken access control
- [Elasticsearch Uncontrolled Resource Consumption vulnerability](https://agentprime.io/advisories/GHSA-w5gg-2q56-6h4f.md)
  `GHSA-w5gg-2q56-6h4f`, `BIT-elasticsearch-2024-23450`, `CVE-2024-23450` · Maven `org.elasticsearch:elasticsearch`: affected `>=7.0.0, <7.17.19 || >=8.0.0, <8.13.0`, fixed in `7.17.19`, `8.13.0` · CVSS 4.9 Medium · Not analysed yet · Published 27 Mar 2024 · Tags: Denial of service
- [Eclipse Vert.x memory leak](https://agentprime.io/advisories/GHSA-5667-3wch-7q7w.md)
  `GHSA-5667-3wch-7q7w`, `CVE-2024-1023` · Maven `io.vertx:vertx-core`: affected `>=4.5.0, <4.5.2 || >=4.4.5, <4.4.7`, fixed in `4.5.2`, `4.4.7` · CVSS 6.5 Medium · Not analysed yet · Published 27 Mar 2024 · Tags: Memory corruption, Information disclosure, Denial of service
- [Ignite Realtime Openfire privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-6pwg-gg6j-5crm.md)
  `GHSA-6pwg-gg6j-5crm`, `CVE-2024-25421` · Maven `org.igniterealtime.openfire:xmppserver`: affected `<4.8.1`, fixed in `4.8.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2024 · Tags: Privilege escalation, Broken access control
- [Ignite Realtime Openfire privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-5xvc-rwv8-86p7.md)
  `GHSA-5xvc-rwv8-86p7`, `CVE-2024-25420` · Maven `org.igniterealtime.openfire:xmppserver`: affected `<4.8.1`, fixed in `4.8.1` · CVSS 7.2 High · Not analysed yet · Published 26 Mar 2024 · Tags: Broken access control, CWE-273
- [Netty's HttpPostRequestDecoder can OOM](https://agentprime.io/advisories/GHSA-5jpm-x58v-624v.md)
  `GHSA-5jpm-x58v-624v`, `CVE-2024-29025` · Maven `io.netty:netty-codec-http`: affected `<4.1.108.Final`, fixed in `4.1.108.Final` · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: Denial of service
- [XNIO denial of service vulnerability](https://agentprime.io/advisories/GHSA-7f88-5hhx-67m2.md)
  `GHSA-7f88-5hhx-67m2`, `CVE-2023-5685` · Maven `org.jboss.xnio:xnio-api`: affected `<3.8.14.Final`, fixed in `3.8.14.Final` · CVSS 7.5 High · Not analysed yet · Published 22 Mar 2024 · Tags: Denial of service
- [Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()](https://agentprime.io/advisories/GHSA-xjp4-hw94-mvp5.md)
  `GHSA-xjp4-hw94-mvp5`, `CVE-2024-29131` · Maven `org.apache.commons:commons-configuration2`: affected `>=2.0, <2.10.1`, fixed in `2.10.1` · CVSS 6.5 Medium · Not analysed yet · Published 21 Mar 2024 · Tags: Memory corruption
- [Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree](https://agentprime.io/advisories/GHSA-9w38-p64v-xpmv.md)
  `GHSA-9w38-p64v-xpmv`, `CVE-2024-29133` · Maven `org.apache.commons:commons-configuration2`: affected `>=2.0, <2.10.1`, fixed in `2.10.1` · CVSS 6.5 Medium · Not analysed yet · Published 21 Mar 2024 · Tags: Memory corruption
- [SQL injection in Folio Spring Module Core](https://agentprime.io/advisories/GHSA-4h5h-p23f-hjqf.md)
  `GHSA-4h5h-p23f-hjqf`, `CVE-2022-4963` · Maven `org.folio:spring-module-core`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 5.5 Medium · Not analysed yet · Published 21 Mar 2024 · Tags: SQL injection
- [Improper Authentication in Spring Authorization Server](https://agentprime.io/advisories/GHSA-x637-x8p3-5p22.md)
  `GHSA-x637-x8p3-5p22`, `CVE-2024-22258` · Maven `org.springframework.security:spring-security-oauth2-authorization-server`: affected `<1.1.6 || >=1.2.0, <1.2.3`, fixed in `1.1.6`, `1.2.3` · CVSS 6.1 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Authentication bypass, Code injection
- [GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-88wc-fcj9-q3r9.md)
  `GHSA-88wc-fcj9-q3r9`, `CVE-2024-23821` · Maven `org.geoserver:gs-gwc`: affected `>=2.24.0, <2.24.1 || <2.23.4`, fixed in `2.24.1`, `2.23.4` · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site scripting (XSS)
- [GeoServer's MapML HTML Page vulnerable to Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-7x76-57fr-m5r5.md)
  `GHSA-7x76-57fr-m5r5`, `CVE-2024-23819` · Maven `org.geoserver.extension:gs-mapml`: affected `<2.23.4 || >=2.24.0, <2.24.1`, fixed in `2.23.4`, `2.24.1` · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site scripting (XSS)
- [GeoServer's WMS OpenLayers Format vulnerable to Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-fcpm-hchj-mh72.md)
  `GHSA-fcpm-hchj-mh72`, `CVE-2024-23818` · Maven `org.geoserver:gs-wms`: affected `<2.23.3 || >=2.24.0, <2.24.1`, fixed in `2.23.3`, `2.24.1` · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site scripting (XSS)
- [GeoServer's GWC Seed Form vulnerable to Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-56r3-f536-5gf7.md)
  `GHSA-56r3-f536-5gf7`, `CVE-2024-23643` · Maven `org.geoserver:gs-gwc-rest`: affected `<2.23.2 || >=2.24.0, <2.24.1`, fixed in `2.23.2`, `2.24.1` · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site scripting (XSS)
- [GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-fg9v-56hw-g525.md)
  `GHSA-fg9v-56hw-g525`, `CVE-2024-23642` · Maven `org.geoserver:gs-wms`: affected `<2.23.4 || >=2.24.0, <2.24.1`, fixed in `2.23.4`, `2.24.1` · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site scripting (XSS)
- [GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-9rfr-pf2x-g4xf.md)
  `GHSA-9rfr-pf2x-g4xf`, `CVE-2024-23640` · Maven `org.geoserver:gs-main` and 1 more: affected `<2.23.3`, fixed in `2.23.3` · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site scripting (XSS)
- [GeoServer Arbitrary file renaming vulnerability in REST Coverage/Data Store API](https://agentprime.io/advisories/GHSA-75m5-hh4r-q9gx.md)
  `GHSA-75m5-hh4r-q9gx`, `CVE-2024-23634` · Maven `org.geoserver:gs-restconfig`: affected `<2.23.5 || >=2.24.0, <2.24.2`, fixed in `2.23.5`, `2.24.2` · CVSS 6.0 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Path traversal, CWE-20
- [Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API](https://agentprime.io/advisories/GHSA-fh7p-5f6g-vj2w.md)
  `GHSA-fh7p-5f6g-vj2w`, `CVE-2023-51445` · Maven `org.geoserver:gs-restconfig`: affected `<2.23.3`, fixed in `2.23.3` · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API](https://agentprime.io/advisories/GHSA-9v5q-2gwq-q9hq.md)
  `GHSA-9v5q-2gwq-q9hq`, `CVE-2023-51444` · Maven `org.geoserver:gs-platform` and 1 more: affected `<2.23.4 || >=2.24.0, <2.24.1`, fixed in `2.23.4`, `2.24.1` · CVSS 7.2 High · Not analysed yet · Published 20 Mar 2024 · Tags: Unrestricted file upload, CWE-20
- [GeoServer log file path traversal vulnerability](https://agentprime.io/advisories/GHSA-8g7v-vjrc-x4g5.md)
  `GHSA-8g7v-vjrc-x4g5`, `CVE-2023-41877` · Maven `org.geoserver:gs-main`: affected `<=2.23.4`, no fixed version yet · CVSS 7.2 High · Not analysed yet · Published 20 Mar 2024 · Tags: Path traversal
- [Cross-Site Request Forgery in Apache Wicket](https://agentprime.io/advisories/GHSA-8vvp-525h-cxf9.md)
  `GHSA-8vvp-525h-cxf9`, `CVE-2024-27439` · Maven `org.apache.wicket:wicket`: affected `>=9.1.0, <9.17.0 || >=10.0.0-M1, <10.0.0`, fixed in `9.17.0`, `10.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: Cross-site request forgery (CSRF), HTTP request smuggling
- [Improper Input Validation vulnerability in Apache Hop Engine](https://agentprime.io/advisories/GHSA-f6g6-pjgc-5cj5.md)
  `GHSA-f6g6-pjgc-5cj5`, `CVE-2024-24683` · Maven `org.apache.hop:hop`: affected `<2.8.0`, fixed in `2.8.0` · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-20
- [Path traversal in flaskcode Devan-Kerman ARRP](https://agentprime.io/advisories/GHSA-cg24-jjr5-rxmf.md)
  `GHSA-cg24-jjr5-rxmf`, `CVE-2024-24042` · Maven `net.devtech:arrp`: affected `<0.8.2`, fixed in `0.8.2` · CVSS 8.8 High · Not analysed yet · Published 19 Mar 2024 · Tags: Path traversal
- [Erroneous authentication pass in Spring Security](https://agentprime.io/advisories/GHSA-f3jh-qvm4-mg39.md)
  `GHSA-f3jh-qvm4-mg39`, `CVE-2024-22257` · Maven `org.springframework.security:spring-security-core`: affected `<5.7.12 || >=5.8.0, <5.8.11 || >=6.0.0, <6.1.8 || >=6.2.0, <6.2.3`, fixed in `5.7.12`, `5.8.11`, `6.1.8`, `6.2.3` · CVSS 8.2 High · Not analysed yet · Published 18 Mar 2024 · Tags: Authentication bypass, Broken access control
- [FitNesse Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-mjq8-gg9x-87gr.md)
  `GHSA-mjq8-gg9x-87gr`, `CVE-2024-28128` · Maven `org.fitnesse:fitnesse`: affected `<20220319`, fixed in `20220319` · CVSS 6.1 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: Cross-site scripting (XSS)
- [FitNesse allows execution of arbitrary OS commands](https://agentprime.io/advisories/GHSA-x9r9-48rm-4xm6.md)
  `GHSA-x9r9-48rm-4xm6`, `CVE-2024-28125` · Maven `org.fitnesse:fitnesse`: affected `<=20240707`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2024 · Tags: Command injection
- [Spring Framework URL Parsing with Host Validation Vulnerability](https://agentprime.io/advisories/GHSA-hgjh-9rj2-g67j.md)
  `GHSA-hgjh-9rj2-g67j`, `CVE-2024-22259` · Maven `org.springframework:spring-web`: affected `>=6.1.0, <6.1.5 || >=6.0.0, <6.0.18 || <5.3.33`, fixed in `6.1.5`, `6.0.18`, `5.3.33` · CVSS 8.1 High · Not analysed yet · Published 16 Mar 2024 · Tags: Open redirect
- [Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling](https://agentprime.io/advisories/GHSA-r978-9m6m-6gm6.md)
  `GHSA-r978-9m6m-6gm6`, `BIT-zookeeper-2024-23944`, `CVE-2024-23944` · Maven `org.apache.zookeeper:zookeeper`: affected `>=3.8.0, <3.8.4 || >=3.9.0, <3.9.2 || >=3.6.0, <=3.7.2`, fixed in `3.8.4`, `3.9.2` · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2024 · Tags: Information disclosure, Broken access control
- [SSRF vulnerability using the Aegis DataBinding in Apache CXF](https://agentprime.io/advisories/GHSA-qmgx-j96g-4428.md)
  `GHSA-qmgx-j96g-4428`, `CVE-2024-28752` · Maven `org.apache.cxf:cxf-rt-databinding-aegis`: affected `<3.5.8 || >=3.6.0, <3.6.3 || >=4.0.0, <4.0.4`, fixed in `3.5.8`, `3.6.3`, `4.0.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Mar 2024 · Tags: Server-side request forgery (SSRF)
- [Denial of Service via incomplete cleanup vulnerability in Apache Tomcat](https://agentprime.io/advisories/GHSA-v682-8vv8-vpwr.md)
  `GHSA-v682-8vv8-vpwr`, `BIT-tomcat-2024-23672`, `CVE-2024-23672` · Maven `org.apache.tomcat.embed:tomcat-embed-websocket` and 1 more: affected `>=11.0.0-M1, <11.0.0-M17 || >=10.1.0-M1, <10.1.19 || >=9.0.0-M1, <9.0.86 || >=8.5.0, <8.5.99`, fixed in `11.0.0-M17`, `10.1.19`, `9.0.86`, `8.5.99` · CVSS 6.3 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: CWE-459
- [Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests](https://agentprime.io/advisories/GHSA-7w75-32cg-r6g2.md)
  `GHSA-7w75-32cg-r6g2`, `BIT-tomcat-2024-24549`, `CVE-2024-24549` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=8.5.0, <8.5.99 || >=9.0.0-M1, <9.0.86 || >=10.1.0-M1, <10.1.19 || >=11.0.0-M1, <11.0.0-M17`, fixed in `8.5.99`, `9.0.86`, `10.1.19`, `11.0.0-M17` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.23 · Not analysed yet · Published 13 Mar 2024 · Tags: CWE-20
- [In Quarkus, git credentials could be inadvertently published](https://agentprime.io/advisories/GHSA-7g97-7r3c-5cc6.md)
  `GHSA-7g97-7r3c-5cc6`, `CVE-2024-1979` · Maven `io.quarkus:quarkus-kubernetes-deployment`: affected `<3.7.3`, fixed in `3.7.3` · CVSS 3.5 Low · Not analysed yet · Published 13 Mar 2024 · Tags: Information disclosure
- [Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution](https://agentprime.io/advisories/GHSA-xp2r-g8qq-44hh.md)
  `GHSA-xp2r-g8qq-44hh`, `CVE-2024-27135` · Maven `org.apache.pulsar:pulsar-functions-worker`: affected `>=2.4.0, <2.10.6 || >=2.11.0, <2.11.4 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 || >=3.2.0, <3.2.1`, fixed in `2.10.6`, `2.11.4`, `3.0.3`, `3.1.3`, `3.2.1` · CVSS 8.5 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-20, CWE-913
- [Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification](https://agentprime.io/advisories/GHSA-jg2g-4rjg-cmqh.md)
  `GHSA-jg2g-4rjg-cmqh`, `CVE-2024-27317` · Maven `org.apache.pulsar:pulsar-functions-worker`: affected `>=2.4.0, <2.10.6 || >=2.11.0, <2.11.4 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 || >=3.2.0, <3.2.1`, fixed in `2.10.6`, `2.11.4`, `3.0.3`, `3.1.3`, `3.2.1` · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.57 · Not analysed yet · Published 12 Mar 2024 · Tags: Path traversal
- [Apache Pulsar: Improper Authorization For Topic-Level Policy Management](https://agentprime.io/advisories/GHSA-g627-r579-rw35.md)
  `GHSA-g627-r579-rw35`, `CVE-2024-28098` · Maven `org.apache.pulsar:pulsar-broker`: affected `>=3.2.0, <3.2.1 || >=3.1.0, <3.1.3 || >=3.0.0, <3.0.3 || >=2.11.0, <2.11.4 || >=2.7.1, <2.10.6`, fixed in `3.2.1`, `3.1.3`, `3.0.3`, `2.11.4`, `2.10.6` · CVSS 6.4 Medium · Not analysed yet · Published 12 Mar 2024 · Tags: Broken access control
- [Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint](https://agentprime.io/advisories/GHSA-c35h-w8hj-mm55.md)
  `GHSA-c35h-w8hj-mm55`, `CVE-2022-34321` · Maven `org.apache.pulsar:pulsar-proxy`: affected `>=2.6.0, <2.10.6 || >=2.11.0, <2.11.3 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.1`, fixed in `2.10.6`, `2.11.3`, `3.0.2`, `3.1.1` · CVSS 8.2 High · Not analysed yet · Published 12 Mar 2024 · Tags: Authentication bypass
- [Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying](https://agentprime.io/advisories/GHSA-c2x9-vw5h-39vc.md)
  `GHSA-c2x9-vw5h-39vc`, `CVE-2024-27894` · Maven `org.apache.pulsar:pulsar-functions-worker`: affected `>=2.4.0, <2.10.6 || >=2.11.0, <2.11.4 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 || >=3.2.0, <3.2.1`, fixed in `2.10.6`, `2.11.4`, `3.0.3`, `3.1.3`, `3.2.1` · CVSS 8.5 High · Not analysed yet · Published 12 Mar 2024 · Tags: Information disclosure, CWE-20
- [nGrinder vulnerable to unsafe Java objects deserialization](https://agentprime.io/advisories/GHSA-j7jm-8gf5-frcm.md)
  `GHSA-j7jm-8gf5-frcm`, `CVE-2024-28213` · Maven `org.ngrinder:ngrinder-core`: affected `<3.5.9`, fixed in `3.5.9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Mar 2024 · Tags: Insecure deserialization
- [Jenkins Delphix Plugin has SSL/TLS certificate validation disabled by default](https://agentprime.io/advisories/GHSA-xj36-6xc6-8p9x.md)
  `GHSA-xj36-6xc6-8p9x`, `CVE-2024-28161` · Maven `org.jenkins-ci.plugins:delphix`: affected `>=3.0.1, <3.0.2`, fixed in `3.0.2` · CVSS 4.8 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Weak cryptography or TLS

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTAzLTA2VDE4OjMwOjM5LjAwMDAwMFoiLCJHSFNBLXhqMzYtNnhjNi04cDl4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTA0LTEwVDE1OjMwOjM3LjAwMDAwMFoiLCJHSFNBLWpwbXgtOTk2di00OGZtIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTA0LTEwVDE1OjMwOjM3LjAwMDAwMFoiLCJHSFNBLWpwbXgtOTk2di00OGZtIl0>. Everything for agents: <https://agentprime.io/llms.txt>.