# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [veraPDF has potential XSLT injection vulnerability when using policy files](https://agentprime.io/advisories/GHSA-qxqf-2mfx-x8jw.md)
  `GHSA-qxqf-2mfx-x8jw`, `CVE-2024-28109` · Maven `org.verapdf:core` and 8 more: affected `<1.24.2`, fixed in `1.24.2` · CVSS 8.1 High · Not analysed yet · Published 20 May 2024 · Tags: Other injection
- [Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability](https://agentprime.io/advisories/GHSA-76v2-48w6-crxr.md)
  `GHSA-76v2-48w6-crxr`, `CVE-2024-28087` · Maven `org.bonitasoft.engine:bonita-server`: affected `<10.1.0.W11`, fixed in `10.1.0.W11` · CVSS 6.5 Medium · Not analysed yet · Published 15 May 2024 · Tags: Broken access control
- [Amazon JDBC Driver for Redshift SQL Injection via line comment generation](https://agentprime.io/advisories/GHSA-x3wm-hffr-chwm.md)
  `GHSA-x3wm-hffr-chwm`, `CVE-2024-32888` · Maven `com.amazon.redshift:redshift-jdbc42`: affected `<2.1.0.28`, fixed in `2.1.0.28` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2024 · Tags: SQL injection
- [Ant Media Server does not properly authorize non-administrative API calls](https://agentprime.io/advisories/GHSA-g95v-3pj6-j433.md)
  `GHSA-g95v-3pj6-j433`, `CVE-2024-3462` · Maven `io.antmedia:ant-media-server`: affected `<=2.9.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-302
- [Apache Karaf Cave: Cave SSRF and arbitrary file access](https://agentprime.io/advisories/GHSA-338x-hfx8-vx9x.md)
  `GHSA-338x-hfx8-vx9x`, `CVE-2024-34365` · Maven `org.apache.karaf:cave`: affected `<=4.1.2`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2024 · Tags: Server-side request forgery (SSRF), CWE-20
- [Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")](https://agentprime.io/advisories/GHSA-v435-xc8x-wvr9.md)
  `GHSA-v435-xc8x-wvr9`, `CVE-2024-30171` · Maven `org.bouncycastle:bcprov-jdk14` and 9 more: affected `<1.78`, fixed in `1.78` · CVSS 5.9 Medium · Not analysed yet · Published 14 May 2024 · Tags: Information disclosure
- [Bouncy Castle crafted signature and public key can be used to trigger an infinite loop](https://agentprime.io/advisories/GHSA-m44j-cfrm-g8qc.md)
  `GHSA-m44j-cfrm-g8qc`, `CVE-2024-30172` · Maven `org.bouncycastle:bcprov-jdk14` and 7 more: affected `>=1.73, <1.78`, fixed in `1.78` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: Denial of service
- [Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.](https://agentprime.io/advisories/GHSA-8xfc-gm6g-vgpv.md)
  `GHSA-8xfc-gm6g-vgpv`, `CVE-2024-29857` · Maven `org.bouncycastle:bc-fips` and 9 more: affected `<1.0.2.5`, fixed in `1.0.2.5` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: Memory corruption, Denial of service
- [Genie Path Traversal vulnerability via File Uploads](https://agentprime.io/advisories/GHSA-wpcv-5jgp-69f3.md)
  `GHSA-wpcv-5jgp-69f3`, `CVE-2024-4701` · Maven `com.netflix.genie:genie-web`: affected `<4.3.18`, fixed in `4.3.18` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.25 · Not analysed yet · Published 9 May 2024 · Tags: Path traversal
- [Apache Inlong Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-fgh3-pwmp-3qw3.md)
  `GHSA-fgh3-pwmp-3qw3`, `CVE-2024-26579` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.7.0, <1.12.0`, fixed in `1.12.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2024 · Tags: Insecure deserialization
- [Neo4j Cypher component mishandles IMMUTABLE privileges](https://agentprime.io/advisories/GHSA-p343-9qwp-pqxv.md)
  `GHSA-p343-9qwp-pqxv`, `BIT-neo4j-2024-34517`, `BIT-neo4j-enterprise-2024-34517`, `CVE-2024-34517` · Maven `org.neo4j:neo4j-cypher`: affected `>=5.0.0, <5.19.0`, fixed in `5.19.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2024 · Tags: Privilege escalation, CWE-471
- [MS Basic Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-64cm-3cj3-67hf.md)
  `GHSA-64cm-3cj3-67hf`, `CVE-2024-33748` · Maven `net.mingsoft:ms-basic`: affected `<=2.1.13.4`, no fixed version yet · CVSS 4.1 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site scripting (XSS)
- [Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure](https://agentprime.io/advisories/GHSA-2x52-8f29-7cjr.md)
  `GHSA-2x52-8f29-7cjr`, `CVE-2024-4536` · Maven `org.eclipse.edc:connector-core`: affected `>=0.2.1, <0.6.3`, fixed in `0.6.3` · CVSS 6.8 Medium · Not analysed yet · Published 7 May 2024 · Tags: Information disclosure, Hard-coded credentials
- [Bouncy Castle Java Cryptography API vulnerable to DNS poisoning](https://agentprime.io/advisories/GHSA-4h8f-2wvx-gg5w.md)
  `GHSA-4h8f-2wvx-gg5w`, `CVE-2024-34447` · Maven `org.bouncycastle:bcprov-jdk12` and 6 more: affected `>=1.61, <1.78`, fixed in `1.78` · CVSS 5.9 Medium · Not analysed yet · Published 3 May 2024 · Tags: Weak cryptography or TLS
- [Apache Hive Code Injection vulnerability](https://agentprime.io/advisories/GHSA-vpw3-3prf-3974.md)
  `GHSA-vpw3-3prf-3974`, `CVE-2023-35701` · Maven `org.apache.hive:hive-jdbc`: affected `>=4.0.0-alpha-1, <4.0.0`, fixed in `4.0.0` · CVSS 6.6 Medium · Not analysed yet · Published 3 May 2024 · Tags: Code injection
- [Jenkins Git server Plugin does not perform a permission check](https://agentprime.io/advisories/GHSA-xh9c-vcf9-h94m.md)
  `GHSA-xh9c-vcf9-h94m`, `CVE-2024-34146` · Maven `org.jenkins-ci.plugins:git-server`: affected `<117.veb`, fixed in `117.veb` · CVSS 5.3 Medium · Not analysed yet · Published 2 May 2024 · Tags: Privilege escalation, Broken access control
- [Wildfly vulnerable to denial of service](https://agentprime.io/advisories/GHSA-x7g6-rwhc-g7mj.md)
  `GHSA-x7g6-rwhc-g7mj`, `CVE-2024-4029` · Maven `org.wildfly:wildfly-domain-http`: affected `<=24.0.0.Final`, no fixed version yet · CVSS 4.1 Medium · Not analysed yet · Published 2 May 2024 · Tags: Denial of service
- [Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies](https://agentprime.io/advisories/GHSA-v63g-v339-2673.md)
  `GHSA-v63g-v339-2673`, `CVE-2024-34144` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1336.vf33a`, fixed in `1336.vf33a` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.48 · Not analysed yet · Published 2 May 2024 · Tags: CWE-693
- [Jenkins Subversion Partial Release Manager Plugin programmatically disables the fix for CVE-2016-3721](https://agentprime.io/advisories/GHSA-phh3-2p9m-w6j5.md)
  `GHSA-phh3-2p9m-w6j5`, `CVE-2024-34148` · Maven `org.jenkins-ci.plugins:partial-release-manager`: affected `<=1.0.1`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 2 May 2024 · Tags: Prototype pollution
- [Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext](https://agentprime.io/advisories/GHSA-94pr-w968-h923.md)
  `GHSA-94pr-w968-h923`, `CVE-2024-34147` · Maven `org.jenkins-ci.plugins:telegrambot`: affected `<=1.4.0`, no fixed version yet · CVSS 3.3 Low · Not analysed yet · Published 2 May 2024 · Tags: Hard-coded credentials
- [Jenkins Script Security Plugin sandbox bypass vulnerability](https://agentprime.io/advisories/GHSA-2g4q-9vm9-9fw4.md)
  `GHSA-2g4q-9vm9-9fw4`, `CVE-2024-34145` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1336.vf33a`, fixed in `1336.vf33a` · CVSS 8.8 High · Not analysed yet · Published 2 May 2024 · Tags: Authentication bypass
- [Apache ActiveMQ's default configuration doesn't secure the API web context](https://agentprime.io/advisories/GHSA-gj5m-m88j-v7c3.md)
  `GHSA-gj5m-m88j-v7c3`, `BIT-activemq-2024-32114`, `CVE-2024-32114` · Maven `org.apache.activemq:apache-activemq`: affected `>=6.0.0, <6.1.2`, fixed in `6.1.2` · CVSS 8.5 High · Not analysed yet · Published 2 May 2024 · Tags: CWE-1188
- [XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets](https://agentprime.io/advisories/GHSA-chfm-68vv-pvw5.md)
  `GHSA-chfm-68vv-pvw5`, `CVE-2024-31573` · Maven `org.xmlunit:xmlunit-core`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 4.0 Medium · Not analysed yet · Published 1 May 2024 · Tags: CWE-669
- [Quarkus: security checks in resteasy reactive may trigger a denial of service](https://agentprime.io/advisories/GHSA-mv64-86g8-cqq7.md)
  `GHSA-mv64-86g8-cqq7`, `CVE-2024-1726` · Maven `io.quarkus.resteasy.reactive:resteasy-reactive`: affected `>=3.8.0.CR1, <3.8.0 || >=3.3.0.CR1, <3.7.4 || <3.2.11.Final`, fixed in `3.8.0`, `3.7.4`, `3.2.11.Final` · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: CWE-281
- [Jberet: jberet-core logging database credentials](https://agentprime.io/advisories/GHSA-9wmf-xf3h-r8pr.md)
  `GHSA-9wmf-xf3h-r8pr`, `CVE-2024-1102` · Maven `org.jberet:jberet-core`: affected `<2.2.1.Final`, fixed in `2.2.1.Final` · CVSS 6.5 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: Information disclosure, CWE-523
- [Quarkus: authorization flaw in quarkus resteasy reactive and classic](https://agentprime.io/advisories/GHSA-25w4-hfqg-4r52.md)
  `GHSA-25w4-hfqg-4r52`, `CVE-2023-5675` · Maven `io.quarkus:quarkus-resteasy-reactive-common` and 1 more: affected `<3.2.10.Final || >=3.3.0, <3.6.9 || >=3.7.0, <3.7.1`, fixed in `3.2.10.Final`, `3.6.9`, `3.7.1` · CVSS 6.5 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: Broken access control, Authentication bypass
- [OpenMetadata vulnerable to a SpEL Injection in \`GET /api/v1/policies/validation/condition/\<expr>\` (\`GHSL-2023-236\`)](https://agentprime.io/advisories/GHSA-5xv3-fm7g-865r.md)
  `GHSA-5xv3-fm7g-865r`, `CVE-2024-28848` · Maven `org.open-metadata:openmetadata-service`: affected `<1.2.4`, fixed in `1.2.4` · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2024 · Tags: Code injection
- [OpenMetadata vulnerable to a SpEL Injection in \`PUT /api/v1/events/subscriptions\` (\`GHSL-2023-251\`)](https://agentprime.io/advisories/GHSA-8p5r-6mvv-2435.md)
  `GHSA-8p5r-6mvv-2435`, `CVE-2024-28847` · Maven `org.open-metadata:openmetadata-service`: affected `<1.2.4`, fixed in `1.2.4` · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2024 · Tags: Code injection
- [OpenMetadata vulnerable to SpEL Injection in \`PUT /api/v1/policies\` (\`GHSL-2023-252\`)](https://agentprime.io/advisories/GHSA-7vf4-x5m2-r6gr.md)
  `GHSA-7vf4-x5m2-r6gr`, `CVE-2024-28253` · Maven `org.open-metadata:openmetadata-service`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 23 Apr 2024 · Tags: Code injection
- [JADX file override vulnerability](https://agentprime.io/advisories/GHSA-hvp5-5x4f-33fq.md)
  `GHSA-hvp5-5x4f-33fq` · Maven `io.github.skylot:jadx-core`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 3.3 Low · Not analysed yet · Published 22 Apr 2024 · Tags: Path traversal
- [Ant Media Server vulnerable to a local privilege escalation](https://agentprime.io/advisories/GHSA-qwhw-hh9j-54f5.md)
  `GHSA-qwhw-hh9j-54f5`, `CVE-2024-32656` · Maven `io.antmedia:ant-media-server`: affected `>=2.6.0, <2.9.0`, fixed in `2.9.0` · CVSS 7.8 High · Not analysed yet · Published 22 Apr 2024 · Tags: Broken access control
- [Apache HugeGraph-Hubble: SSRF in Hubble connection page](https://agentprime.io/advisories/GHSA-77x4-55q7-4vmj.md)
  `GHSA-77x4-55q7-4vmj`, `CVE-2024-27347` · Maven `org.apache.hugegraph:hugegraph-hubble`: affected `>=1.0.0, <1.3.0`, fixed in `1.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2024 · Tags: Server-side request forgery (SSRF)
- [Apache HugeGraph-Server: Bypass whitelist in Auth mode](https://agentprime.io/advisories/GHSA-6mgp-p75r-vhjm.md)
  `GHSA-6mgp-p75r-vhjm`, `CVE-2024-27349` · Maven `org.apache.hugegraph:hugegraph-api`: affected `>=1.0.0, <1.3.0`, fixed in `1.3.0` · CVSS 8.8 High · Not analysed yet · Published 22 Apr 2024 · Tags: Authentication bypass
- [Apache HugeGraph-Server: Command execution in gremlin](https://agentprime.io/advisories/GHSA-29rc-vq7f-x335.md)
  `GHSA-29rc-vq7f-x335`, `CVE-2024-27348` · Maven `org.apache.hugegraph:hugegraph-api` and 1 more: affected `>=1.0.0, <1.3.0`, fixed in `1.3.0` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 22 Apr 2024 · Tags: Command injection, Broken access control
- [Keycloak vulnerable to impersonation via logout token exchange](https://agentprime.io/advisories/GHSA-7fpj-9hr8-28vh.md)
  `GHSA-7fpj-9hr8-28vh`, `CVE-2023-0657` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 3.4 Low · Not analysed yet · Published 17 Apr 2024 · Tags: Broken access control, Authentication bypass, Weak cryptography or TLS, CWE-273
- [Keycloak vulnerable to session hijacking via re-authentication](https://agentprime.io/advisories/GHSA-c9h6-v78w-52wj.md)
  `GHSA-c9h6-v78w-52wj`, `CVE-2023-6787` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Authentication bypass
- [Keycloak path traversal vulnerability in redirection validation](https://agentprime.io/advisories/GHSA-72vp-xfrc-42xm.md)
  `GHSA-72vp-xfrc-42xm`, `CVE-2024-1132` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 8.1 High · Not analysed yet · Published 17 Apr 2024 · Tags: Path traversal
- [Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS](https://agentprime.io/advisories/GHSA-m6q9-p373-g5q8.md)
  `GHSA-m6q9-p373-g5q8`, `CVE-2024-1249` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 7.4 High · Not analysed yet · Published 17 Apr 2024 · Tags: CWE-346
- [Keycloak vulnerable to log Injection during WebAuthn authentication or registration](https://agentprime.io/advisories/GHSA-j628-q885-8gr5.md)
  `GHSA-j628-q885-8gr5`, `CVE-2023-6484` · Maven `org.keycloak:keycloak-services`: affected `<22.0.9 || >=23.0.0, <23.0.5`, fixed in `22.0.9`, `23.0.5` · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Other injection
- [Keycloak Authorization Bypass vulnerability](https://agentprime.io/advisories/GHSA-46c8-635v-68r2.md)
  `GHSA-46c8-635v-68r2`, `CVE-2023-6544` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 5.4 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: CWE-625
- [Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow](https://agentprime.io/advisories/GHSA-8rmm-gm28-pj8q.md)
  `GHSA-8rmm-gm28-pj8q`, `CVE-2023-6717` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 6.0 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Cross-site scripting (XSS), Open redirect, CWE-20
- [Keycloak secondary factor bypass in step-up authentication](https://agentprime.io/advisories/GHSA-4f53-xh3v-g8x4.md)
  `GHSA-4f53-xh3v-g8x4`, `CVE-2023-3597` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 5.0 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Authentication bypass
- [Keycloak path traversal vulnerability in the redirect validation](https://agentprime.io/advisories/GHSA-mrv8-pqfj-7gp5.md)
  `GHSA-mrv8-pqfj-7gp5`, `CVE-2024-2419` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 7.1 High · Not analysed yet · Published 17 Apr 2024 · Tags: Open redirect, CWE-346
- [BlazeMeter Jenkins plugin vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-r52h-fjm7-93j8.md)
  `GHSA-r52h-fjm7-93j8`, `CVE-2024-3825` · Maven `com.blazemeter.plugins:BlazeMeterJenkinsPlugin`: affected `<4.22`, fixed in `4.22` · CVSS 4.3 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Cross-site request forgery (CSRF)
- [Spring Framework URL Parsing with Host Validation](https://agentprime.io/advisories/GHSA-2wrp-6fg6-hmc5.md)
  `GHSA-2wrp-6fg6-hmc5`, `CVE-2024-22262` · Maven `org.springframework:spring-web`: affected `<5.3.34 || >=6.0.0, <6.0.19 || >=6.1.0, <6.1.6`, fixed in `5.3.34`, `6.0.19`, `6.1.6` · CVSS 8.1 High · Not analysed yet · Published 16 Apr 2024 · Tags: Open redirect, Server-side request forgery (SSRF)
- [Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode](https://agentprime.io/advisories/GHSA-79vv-vp32-gpp7.md)
  `GHSA-79vv-vp32-gpp7`, `BIT-kafka-2024-27309`, `CVE-2024-27309` · Maven `org.apache.kafka:kafka-metadata`: affected `>=3.5.0, <3.6.2`, fixed in `3.6.2` · CVSS 6.8 Medium · Not analysed yet · Published 12 Apr 2024 · Tags: Broken access control
- [Code injection in Apache Zeppelin Shell](https://agentprime.io/advisories/GHSA-8pfj-w89w-m24x.md)
  `GHSA-8pfj-w89w-m24x`, `CVE-2024-31861` · Maven `org.apache.zeppelin:zeppelin-shell`: affected `>=0.10.1, <0.11.1`, fixed in `0.11.1` · No CVSS score · Not analysed yet · Published 11 Apr 2024 · Tags: Code injection
- [XWiki Platform remote code execution from account through UIExtension parameters](https://agentprime.io/advisories/GHSA-c2gg-4gq4-jv5j.md)
  `GHSA-c2gg-4gq4-jv5j`, `CVE-2024-31997` · Maven `org.xwiki.platform:xwiki-platform-uiextension-api`: affected `<14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9-rc-1`, fixed in `14.10.19`, `15.5.4`, `15.9-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.74 · Not analysed yet · Published 10 Apr 2024 · Tags: Broken access control
- [XWiki Commons missing escaping of \`{\` in Velocity escapetool allows remote code execution](https://agentprime.io/advisories/GHSA-hf43-47q4-fhq5.md)
  `GHSA-hf43-47q4-fhq5`, `CVE-2024-31996` · Maven `org.xwiki.commons:xwiki-commons-velocity`: affected `>=3.0.1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9-rc-1`, fixed in `14.10.19`, `15.5.4`, `15.9-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Code injection
- [XWiki Platform CSRF remote code execution through the realtime HTML Converter API](https://agentprime.io/advisories/GHSA-r5vh-gc3r-r24w.md)
  `GHSA-r5vh-gc3r-r24w`, `CVE-2024-31988` · Maven `org.xwiki.platform:xwiki-platform-realtime-ui`: affected `>=13.9-rc-1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9`, fixed in `14.10.19`, `15.5.4`, `15.9` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Cross-site request forgery (CSRF)
- [XWiki Platform remote code execution from account via custom skins support](https://agentprime.io/advisories/GHSA-cv55-v6rw-7r5v.md)
  `GHSA-cv55-v6rw-7r5v`, `CVE-2024-31987` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=6.4-milestone-1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1`, fixed in `14.10.19`, `15.5.4`, `15.10-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Broken access control
- [XWiki Platform CSRF remote code execution through scheduler job's document reference](https://agentprime.io/advisories/GHSA-37m4-hqxv-w26g.md)
  `GHSA-37m4-hqxv-w26g`, `CVE-2024-31986` · Maven `org.xwiki.platform:xwiki-platform-scheduler-ui`: affected `>=3.1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9`, fixed in `14.10.19`, `15.5.4`, `15.9` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Code injection, Cross-site request forgery (CSRF)
- [XWiki Platform CSRF in the job scheduler](https://agentprime.io/advisories/GHSA-j2r6-r929-v6gf.md)
  `GHSA-j2r6-r929-v6gf`, `CVE-2024-31985` · Maven `org.xwiki.platform:xwiki-platform-scheduler-ui`: affected `>=3.1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9`, fixed in `14.10.19`, `15.5.4`, `15.9` · CVSS 5.4 Medium · Not analysed yet · Published 10 Apr 2024 · Tags: Cross-site request forgery (CSRF)
- [XWiki Platform: Remote code execution through space title and Solr space facet](https://agentprime.io/advisories/GHSA-xm4h-3jxr-m3c6.md)
  `GHSA-xm4h-3jxr-m3c6`, `CVE-2024-31984` · Maven `org.xwiki.platform:xwiki-platform-search-solr-ui`: affected `>=7.2-rc-1, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1`, fixed in `14.10.20`, `15.5.4`, `15.10-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.83 · Not analysed yet · Published 10 Apr 2024 · Tags: Code injection
- [XWiki Platform: Remote code execution from edit in multilingual wikis via translations](https://agentprime.io/advisories/GHSA-xxp2-9c9g-7wmj.md)
  `GHSA-xxp2-9c9g-7wmj`, `CVE-2024-31983` · Maven `org.xwiki.platform:xwiki-platform-localization-source-wiki`: affected `>=4.3-milestone-2, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1`, fixed in `14.10.20`, `15.5.4`, `15.10-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Broken access control
- [XWiki Platform: Remote code execution as guest via DatabaseSearch](https://agentprime.io/advisories/GHSA-2858-8cfx-69m9.md)
  `GHSA-2858-8cfx-69m9`, `CVE-2024-31982` · Maven `org.xwiki.platform:xwiki-platform-search-ui`: affected `>=2.4-milestone-1, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1`, fixed in `14.10.20`, `15.5.4`, `15.10-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 10 Apr 2024 · Tags: Code injection
- [XWiki Platform: Privilege escalation (PR) from user registration through PDFClass](https://agentprime.io/advisories/GHSA-vxwr-wpjv-qjq7.md)
  `GHSA-vxwr-wpjv-qjq7`, `CVE-2024-31981` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=3.0.1, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1`, fixed in `14.10.20`, `15.5.4`, `15.10-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Broken access control
- [XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet](https://agentprime.io/advisories/GHSA-34fj-r5gq-7395.md)
  `GHSA-34fj-r5gq-7395`, `CVE-2024-31465` · Maven `org.xwiki.platform:xwiki-platform-search-ui`: affected `>=5.2-milestone-2, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1`, fixed in `14.10.20`, `15.5.4`, `15.10-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.76 · Not analysed yet · Published 10 Apr 2024 · Tags: Code injection
- [XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted](https://agentprime.io/advisories/GHSA-v782-xr4w-3vqx.md)
  `GHSA-v782-xr4w-3vqx`, `CVE-2024-31464` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=5.0-rc-1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9-rc-1`, fixed in `14.10.19`, `15.5.4`, `15.9-rc-1` · CVSS 6.8 Medium · Not analysed yet · Published 10 Apr 2024 · Tags: Information disclosure, Weak cryptography or TLS
- [WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log](https://agentprime.io/advisories/GHSA-jpmx-996v-48fm.md)
  `GHSA-jpmx-996v-48fm`, `CVE-2023-6236` · Maven `org.wildfly.security:wildfly-elytron-http-oidc`: affected `<2.2.5.Final`, fixed in `2.2.5.Final` · CVSS 7.3 High · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-345

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTA0LTEwVDE1OjMwOjM3LjAwMDAwMFoiLCJHSFNBLWpwbXgtOTk2di00OGZtIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTA1LTIyVDE4OjMwOjQwLjAwMDAwMFoiLCJHSFNBLTlycnctODJyMi02MjNwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTA1LTIyVDE4OjMwOjQwLjAwMDAwMFoiLCJHSFNBLTlycnctODJyMi02MjNwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.