# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Absent Input Validation in BinaryHttpParser](https://agentprime.io/advisories/GHSA-q8f2-hxq5-cp4h.md)
  `GHSA-q8f2-hxq5-cp4h`, `CVE-2024-40642` · Maven `io.netty.incubator:netty-incubator-codec-bhttp`: affected `<0.0.13.Final`, fixed in `0.0.13.Final` · CVSS 8.1 High · Not analysed yet · Published 18 Jul 2024 · Tags: CWE-20
- [The OpenSearch reporting plugin improperly controls tenancy access to reporting resources](https://agentprime.io/advisories/GHSA-xmvg-335g-x44q.md)
  `GHSA-xmvg-335g-x44q`, `CVE-2024-39900` · Maven `org.opensearch.plugin:opensearch-reports-scheduler`: affected `<2.14.0.0`, fixed in `2.14.0.0` · CVSS 5.4 Medium · Not analysed yet · Published 18 Jul 2024 · Tags: Broken access control
- [Apache StreamPark: FreeMarker SSTI RCE Vulnerability](https://agentprime.io/advisories/GHSA-vv8h-m63v-53pq.md)
  `GHSA-vv8h-m63v-53pq`, `CVE-2024-29178` · Maven `org.apache.streampark:streampark`: affected `<2.1.4`, fixed in `2.1.4` · CVSS 8.8 High · Not analysed yet · Published 18 Jul 2024 · Tags: Code injection
- [Apache StreamPark: Information leakage vulnerability](https://agentprime.io/advisories/GHSA-hcf8-5j78-887v.md)
  `GHSA-hcf8-5j78-887v`, `CVE-2024-29120` · Maven `org.apache.streampark:streampark`: affected `>=2.0.0, <2.1.4`, fixed in `2.1.4` · CVSS 5.9 Medium · Not analysed yet · Published 17 Jul 2024 · Tags: Information disclosure, CWE-212
- [Eclipse Parsson stack overflow when parsing deeply nested input](https://agentprime.io/advisories/GHSA-2rwm-xv5j-777p.md)
  `GHSA-2rwm-xv5j-777p`, `CVE-2023-7272` · Maven `org.eclipse.parsson:parsson`: affected `>=1.1.0, <1.1.3 || <1.0.4`, fixed in `1.1.3`, `1.0.4` · CVSS 8.6 High · Not analysed yet · Published 17 Jul 2024 · Tags: Memory corruption
- [Apache StreamPark: Unchecked maven build params could trigger remote command execution](https://agentprime.io/advisories/GHSA-7g94-hfqc-q993.md)
  `GHSA-7g94-hfqc-q993`, `CVE-2023-52291` · Maven `org.apache.streampark:streampark`: affected `<2.1.4`, fixed in `2.1.4` · CVSS 4.7 Medium · Not analysed yet · Published 17 Jul 2024 · Tags: Command injection
- [Apache StreamPark: maven build params could trigger remote command execution](https://agentprime.io/advisories/GHSA-5v69-92vw-fmjh.md)
  `GHSA-5v69-92vw-fmjh`, `CVE-2024-29737` · Maven `org.apache.streampark:streampark`: affected `<2.1.4`, fixed in `2.1.4` · CVSS 4.7 Medium · Not analysed yet · Published 17 Jul 2024 · Tags: Command injection
- [Apache Linkis DataSource's JDBC Datasource Module with DB2 has JNDI Injection vulnerability](https://agentprime.io/advisories/GHSA-7qpc-4xx9-x5qw.md)
  `GHSA-7qpc-4xx9-x5qw`, `CVE-2023-49566` · Maven `org.apache.linkis:linkis-datasource`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 8.8 High · Not analysed yet · Published 15 Jul 2024 · Tags: Insecure deserialization
- [Apache Linkis DataSource remote code execution vulnerability](https://agentprime.io/advisories/GHSA-jjvc-v8gw-5255.md)
  `GHSA-jjvc-v8gw-5255`, `CVE-2023-46801` · Maven `org.apache.linkis:linkis-datasource`: affected `>=1.4.0, <1.6.0`, fixed in `1.6.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2024 · Tags: Insecure deserialization
- [Apache Linkis DataSource allows arbitrary file reading](https://agentprime.io/advisories/GHSA-f22j-9j59-33j4.md)
  `GHSA-f22j-9j59-33j4`, `CVE-2023-41916` · Maven `org.apache.linkis:linkis-datasource`: affected `>=1.4.0, <1.6.0`, fixed in `1.6.0` · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: Information disclosure
- [Apache Wicket: Remote code execution via XSLT injection](https://agentprime.io/advisories/GHSA-hhwc-gh8h-9rrp.md)
  `GHSA-hhwc-gh8h-9rrp`, `CVE-2024-36522` · Maven `org.apache.wicket:wicket-util`: affected `>=10.0.0-M1, <10.1.0 || >=9.0.0, <9.18.0 || >=8.0.0, <8.16.0`, fixed in `10.1.0`, `9.18.0`, `8.16.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jul 2024 · Tags: Other injection
- [Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-vc8w-jr9v-vj7f.md)
  `GHSA-vc8w-jr9v-vj7f`, `CVE-2024-6531` · Maven `org.webjars:bootstrap` and 6 more: affected `>=4.0.0, <5.0.0`, fixed in `5.0.0` · CVSS 6.4 Medium · Withdrawn · Not analysed yet · Published 11 Jul 2024 · Tags: Cross-site scripting (XSS)
- [Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-9mvj-f7w8-pvh2.md)
  `GHSA-9mvj-f7w8-pvh2`, `CVE-2024-6484` · Maven `org.webjars:bootstrap` and 8 more: affected `>=2.0.0, <=3.4.1`, no fixed version yet · CVSS 6.4 Medium · Withdrawn · Not analysed yet · Published 11 Jul 2024 · Tags: Cross-site scripting (XSS)
- [OpenSearch Observability does not properly restrict access to private tenant resources](https://agentprime.io/advisories/GHSA-77vc-rj32-2r33.md)
  `GHSA-77vc-rj32-2r33`, `CVE-2024-39901` · Maven `org.opensearch.plugin:opensearch-observability`: affected `<2.14.0.0`, fixed in `2.14.0.0` · CVSS 4.2 Medium · Not analysed yet · Published 10 Jul 2024 · Tags: Broken access control
- [Silverpeas Core Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-vfwh-gvf6-mff8.md)
  `GHSA-vfwh-gvf6-mff8`, `CVE-2024-39031` · Maven `org.silverpeas.core:silverpeas-core-rs` and 1 more: affected `<=6.3.5`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Cross-site scripting (XSS)
- [Spring Cloud Function Framework vulnerable to Denial of Service](https://agentprime.io/advisories/GHSA-j4r7-p9fp-w3f3.md)
  `GHSA-j4r7-p9fp-w3f3`, `CVE-2024-22271` · Maven `org.springframework.cloud:spring-cloud-function-context`: affected `>=4.0.0, <4.0.8 || >=4.1.0, <4.1.2`, fixed in `4.0.8`, `4.1.2` · CVSS 8.2 High · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-20
- [Undertow Missing Release of Memory after Effective Lifetime vulnerability](https://agentprime.io/advisories/GHSA-ch7q-gpff-h9hp.md)
  `GHSA-ch7q-gpff-h9hp`, `CVE-2024-3653` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Alpha1, <2.3.15.Final || <2.2.34.Final`, fixed in `2.3.15.Final`, `2.2.34.Final` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Denial of service
- [Undertow Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-xpp6-8r3j-ww43.md)
  `GHSA-xpp6-8r3j-ww43`, `CVE-2024-5971` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Alpha1, <2.3.15.Final || <2.2.34.Final`, fixed in `2.3.15.Final`, `2.2.34.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2024 · Tags: Denial of service
- [Apache NiFi vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-h658-qqv9-qwv8.md)
  `GHSA-h658-qqv9-qwv8`, `CVE-2024-37389` · Maven `org.apache.nifi:nifi-web-ui`: affected `>=1.10.0, <1.27.0 || >=2.0.0-M1, <2.0.0-M4`, fixed in `1.27.0`, `2.0.0-M4` · CVSS 4.6 Medium · EPSS 0.24 · Not analysed yet · Published 8 Jul 2024 · Tags: Cross-site scripting (XSS)
- [Apache Tomcat - Denial of Service](https://agentprime.io/advisories/GHSA-wm9w-rjj3-j356.md)
  `GHSA-wm9w-rjj3-j356`, `BIT-tomcat-2024-34750`, `CVE-2024-34750` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.0-M21 || >=10.1.0-M1, <10.1.25 || >=9.0.0-M1, <9.0.90 || >=8.5.0, <=8.5.100`, fixed in `11.0.0-M21`, `10.1.25`, `9.0.90` · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2024 · Tags: Denial of service, CWE-755
- [Remote Code Execution (RCE) vulnerability in geoserver](https://agentprime.io/advisories/GHSA-6jj6-gm7p-fcvv.md)
  `GHSA-6jj6-gm7p-fcvv`, `CVE-2024-36401` · Maven `org.geoserver:gs-wfs` and 2 more: affected `>=2.24.0, <2.24.4 || >=2.25.0, <2.25.2 || >=2.23.0, <2.23.6 || <2.22.6`, fixed in `2.24.4`, `2.25.2`, `2.23.6`, `2.22.6` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 1 Jul 2024 · Tags: Code injection
- [Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat](https://agentprime.io/advisories/GHSA-jhqx-5v5g-mpf3.md)
  `GHSA-jhqx-5v5g-mpf3`, `CVE-2024-24749` · Maven `org.geoserver:gs-gwc` and 1 more: affected `<2.23.5 || >=2.24.0, <2.24.3`, fixed in `2.23.5`, `2.24.3` · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2024 · Tags: Path traversal
- [GeoServer's Server Status shows sensitive environmental variables and Java properties](https://agentprime.io/advisories/GHSA-j59v-vgcr-hxvf.md)
  `GHSA-j59v-vgcr-hxvf`, `CVE-2024-34696` · Maven `org.geoserver:gs-main` and 1 more: affected `>=2.10.0, <2.24.4 || >=2.25.0, <2.25.1`, fixed in `2.24.4`, `2.25.1` · CVSS 4.5 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Information disclosure
- [Exposure of secrets through system log in Jenkins Structs Plugin](https://agentprime.io/advisories/GHSA-xfx3-cr74-x3cv.md)
  `GHSA-xfx3-cr74-x3cv`, `CVE-2024-39458` · Maven `org.jenkins-ci.plugins:structs`: affected `<338.v848422169819`, fixed in `338.v848422169819` · CVSS 3.1 Low · Not analysed yet · Published 26 Jun 2024 · Tags: Information disclosure
- [Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin](https://agentprime.io/advisories/GHSA-x8mf-jcmf-r79f.md)
  `GHSA-x8mf-jcmf-r79f`, `CVE-2024-39460` · Maven `org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source`: affected `<887.va`, fixed in `887.va` · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2024 · Tags: Information disclosure
- [Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin](https://agentprime.io/advisories/GHSA-3cpq-rw36-cppv.md)
  `GHSA-3cpq-rw36-cppv`, `CVE-2024-39459` · Maven `org.jenkins-ci.plugins:plain-credentials`: affected `<183.va`, fixed in `183.va` · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2024 · Tags: Weak cryptography or TLS, Information disclosure
- [DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document](https://agentprime.io/advisories/GHSA-94cc-xjxr-pwvf.md)
  `GHSA-94cc-xjxr-pwvf`, `CVE-2024-38364` · Maven `org.dspace:dspace-server-webapp`: affected `>=7.0, <7.6.2`, fixed in `7.6.2` · CVSS 2.6 Low · Not analysed yet · Published 25 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java](https://agentprime.io/advisories/GHSA-683x-4444-jxh8.md)
  `GHSA-683x-4444-jxh8`, `CVE-2024-38374` · Maven `org.cyclonedx:cyclonedx-core-java`: affected `>=2.1.0, <9.0.4`, fixed in `9.0.4` · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2024 · Tags: XML external entities (XXE)
- [XWiki programming rights may be inherited by inclusion](https://agentprime.io/advisories/GHSA-qcj3-wpgm-qpxh.md)
  `GHSA-qcj3-wpgm-qpxh`, `CVE-2024-38369` · Maven `org.xwiki.platform:xwiki-platform-rendering-macro-include`: affected `<15.0-rc-1`, fixed in `15.0-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2024 · Tags: Broken access control
- [Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation](https://agentprime.io/advisories/GHSA-cf3q-vg8w-mw84.md)
  `GHSA-cf3q-vg8w-mw84`, `CVE-2024-29868` · Maven `org.apache.streampipes:streampipes-resource-management`: affected `>=0.69.0, <0.95.0`, fixed in `0.95.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2024 · Tags: Weak cryptography or TLS
- [Cross site scripting in Apache JSPWiki](https://agentprime.io/advisories/GHSA-36gf-vpj2-j42w.md)
  `GHSA-36gf-vpj2-j42w`, `CVE-2024-27136` · Maven `org.apache.jspwiki:jspwiki-main`: affected `<2.12.2`, fixed in `2.12.2` · CVSS 6.3 Medium · EPSS 0.61 · Not analysed yet · Published 24 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Keycloak leaks configured LDAP bind credentials through the Keycloak admin console](https://agentprime.io/advisories/GHSA-c25h-c27q-5qpv.md)
  `GHSA-c25h-c27q-5qpv`, `CVE-2024-5967` · Maven `org.keycloak:keycloak-ldap-federation`: affected `>=25.0.0, <25.0.1 || <22.0.12 || >=23.0.0, <24.0.6`, fixed in `25.0.1`, `22.0.12`, `24.0.6` · CVSS 2.7 Low · Not analysed yet · Published 21 Jun 2024 · Tags: Broken access control
- [ClassGraph XML External Entity Reference](https://agentprime.io/advisories/GHSA-v2xm-76pq-phcf.md)
  `GHSA-v2xm-76pq-phcf`, `CVE-2021-47621` · Maven `io.github.classgraph:classgraph`: affected `<4.8.112`, fixed in `4.8.112` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jun 2024 · Tags: XML external entities (XXE)
- [XWiki Platform allows remote code execution from user account](https://agentprime.io/advisories/GHSA-j584-j2vj-3f93.md)
  `GHSA-j584-j2vj-3f93`, `CVE-2024-37899` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=13.4.7, <14.10.21 || >=13.10.3, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.6 || >=16.0.0-rc-1, <16.0.0`, fixed in `14.10.21`, `15.5.5`, `15.10.6`, `16.0.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jun 2024 · Tags: Code injection, Privilege escalation
- [Undertow's url-encoded request path information can be broken on ajp-listener](https://agentprime.io/advisories/GHSA-9442-gm4v-r222.md)
  `GHSA-9442-gm4v-r222`, `CVE-2024-6162` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Alpha1, <2.3.14.Final || <2.2.33.Final`, fixed in `2.3.14.Final`, `2.2.33.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2024 · Tags: Denial of service, CWE-488
- [Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials](https://agentprime.io/advisories/GHSA-gmrm-8fx4-66x7.md)
  `GHSA-gmrm-8fx4-66x7` · Maven `org.keycloak:keycloak-core`: affected `<=24.0.5`, no fixed version yet · CVSS 2.7 Low · Withdrawn · Not analysed yet · Published 18 Jun 2024 · Tags: Broken access control
- [STRIMZI incorrect access control](https://agentprime.io/advisories/GHSA-q2xx-f8r3-9mg5.md)
  `GHSA-q2xx-f8r3-9mg5`, `CVE-2024-36543` · Maven `io.strimzi:strimzi`: affected `<=0.41.0`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 17 Jun 2024 · Tags: Authentication bypass, Denial of service
- [DeepJavaLibrary API absolute path traversal](https://agentprime.io/advisories/GHSA-w877-jfw7-46rj.md)
  `GHSA-w877-jfw7-46rj`, `CVE-2024-37902` · Maven `ai.djl:api`: affected `>=0.1.0, <0.28.0`, fixed in `0.28.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2024 · Tags: Path traversal
- [SonarQube logs sensitive information](https://agentprime.io/advisories/GHSA-hw2c-8xgw-mf57.md)
  `GHSA-hw2c-8xgw-mf57`, `CVE-2024-38460` · Maven `org.sonarsource.sonarqube:sonar-web`: affected `<9.9.4`, fixed in `9.9.4` · CVSS 4.9 Medium · Not analysed yet · Published 16 Jun 2024 · Tags: Information disclosure
- [CrateDB has a Client initialized Session-Renegotiation DoS](https://agentprime.io/advisories/GHSA-x268-qpg6-w9g2.md)
  `GHSA-x268-qpg6-w9g2`, `CVE-2024-37309` · Maven `io.crate:crate`: affected `<5.7.2`, fixed in `5.7.2` · CVSS 5.3 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: Denial of service
- [Elasticsearch StackOverflow vulnerability](https://agentprime.io/advisories/GHSA-4q22-422g-m4pj.md)
  `GHSA-4q22-422g-m4pj`, `BIT-elasticsearch-2024-37280`, `CVE-2024-37280` · Maven `org.elasticsearch:elasticsearch`: affected `>=8.13.1, <8.14.0`, fixed in `8.14.0` · CVSS 4.9 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: Memory corruption
- [Keycloak Denial of Service via account lockout](https://agentprime.io/advisories/GHSA-cq42-vhv7-xr7p.md)
  `GHSA-cq42-vhv7-xr7p`, `CVE-2024-1722` · Maven `org.keycloak:keycloak-services`: affected `<24.0.0`, fixed in `24.0.0` · CVSS 3.7 Low · Not analysed yet · Published 12 Jun 2024 · Tags: CWE-640, CWE-645
- [Keycloak's improper input validation allows using email as username](https://agentprime.io/advisories/GHSA-4vc8-pg5c-vg4x.md)
  `GHSA-4vc8-pg5c-vg4x`, `CVE-2021-3754` · Maven `org.keycloak:keycloak-services`: affected `<24.0.1`, fixed in `24.0.1` · CVSS 3.7 Low · Not analysed yet · Published 12 Jun 2024 · Tags: CWE-20, CWE-670
- [Apache Submarine Server Core has a SQL Injection Vulnerability](https://agentprime.io/advisories/GHSA-v74c-qc46-9gg9.md)
  `GHSA-v74c-qc46-9gg9`, `CVE-2024-36263` · Maven `org.apache.submarine:submarine-server-core`: affected `<=0.8.0`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 12 Jun 2024 · Tags: SQL injection
- [Keycloak's admin API allows low privilege users to use administrative functions](https://agentprime.io/advisories/GHSA-2cww-fgmg-4jqc.md)
  `GHSA-2cww-fgmg-4jqc`, `CVE-2024-3656` · Maven `org.keycloak:keycloak-services`: affected `<24.0.5`, fixed in `24.0.5` · CVSS 8.1 High · Not analysed yet · Published 11 Jun 2024 · Tags: Information disclosure, Privilege escalation, Broken access control
- [Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-m5vv-6r4h-3vj9.md)
  `GHSA-m5vv-6r4h-3vj9`, `CVE-2024-35255`, `GO-2024-2918`, `PYSEC-2026-1209` · Go `github.com/Azure/azure-sdk-for-go/sdk/azidentity` and 7 more: affected `<1.6.0-beta.4.0.20240610221955-50774cd97099`, fixed in `1.6.0-beta.4.0.20240610221955-50774cd97099` · CVSS 5.5 Medium · Not analysed yet · Published 11 Jun 2024 · Tags: Race condition
- [Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)](https://agentprime.io/advisories/GHSA-69fp-7c8p-crjr.md)
  `GHSA-69fp-7c8p-crjr`, `CVE-2024-4540` · Maven `org.keycloak:keycloak-services`: affected `<24.0.5`, fixed in `24.0.5` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2024 · Tags: Information disclosure
- [Weak encryption in Ninja Core](https://agentprime.io/advisories/GHSA-92wp-jghr-hh87.md)
  `GHSA-92wp-jghr-hh87`, `CVE-2024-36823` · Maven `org.ninjaframework:ninja-core`: affected `=7.0.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 7 Jun 2024 · Tags: Weak cryptography or TLS
- [BoringSSLAEADContext in Netty Repeats Nonces](https://agentprime.io/advisories/GHSA-g762-h86w-8749.md)
  `GHSA-g762-h86w-8749`, `CVE-2024-36121` · Maven `io.netty.incubator:netty-incubator-codec-ohttp`: affected `>=0.0.3.Final, <0.0.11.Final`, fixed in `0.0.11.Final` · CVSS 5.9 Medium · Not analysed yet · Published 5 Jun 2024 · Tags: Memory corruption, Information disclosure, CWE-323
- [iq80 Snappy out-of-bounds read when uncompressing data, leading to JVM crash](https://agentprime.io/advisories/GHSA-8wh2-6qhj-h7j9.md)
  `GHSA-8wh2-6qhj-h7j9`, `CVE-2024-36124` · Maven `org.iq80.snappy:snappy`: affected `<0.5`, fixed in `0.5` · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: Memory corruption
- [Duplicate Advisory: Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)](https://agentprime.io/advisories/GHSA-4vrx-8phj-x3mg.md)
  `GHSA-4vrx-8phj-x3mg` · Maven `org.keycloak:keycloak-services`: affected `<24.0.5`, fixed in `24.0.5` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 3 Jun 2024 · Tags: Information disclosure
- [Silverpeas authentication bypass](https://agentprime.io/advisories/GHSA-4w54-wwc9-x62c.md)
  `GHSA-4w54-wwc9-x62c`, `CVE-2024-36042` · Maven `org.silverpeas.core:silverpeas-core`: affected `<6.3.5`, fixed in `6.3.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2024 · Tags: Authentication bypass
- [Decompressors can crash the JVM and leak memory content in Aircompressor](https://agentprime.io/advisories/GHSA-973x-65j7-xcf4.md)
  `GHSA-973x-65j7-xcf4`, `CVE-2024-36114` · Maven `io.airlift:aircompressor`: affected `<0.27`, fixed in `0.27` · CVSS 8.6 High · Not analysed yet · Published 2 Jun 2024 · Tags: Memory corruption
- [OpenCMS Cross-Site Scripting vulnerability](https://agentprime.io/advisories/GHSA-vg6x-pchq-98mg.md)
  `GHSA-vg6x-pchq-98mg`, `CVE-2024-5520` · Maven `org.opencms:opencms-core`: affected `>=16.0, <17.0`, fixed in `17.0` · CVSS 6.4 Medium · Not analysed yet · Published 30 May 2024 · Tags: Cross-site scripting (XSS)
- [OpenAPI Generator Online - Arbitrary File Read/Delete](https://agentprime.io/advisories/GHSA-g3hr-p86p-593h.md)
  `GHSA-g3hr-p86p-593h`, `CVE-2024-35219` · Maven `org.openapitools:openapi-generator-online`: affected `<7.6.0`, fixed in `7.6.0` · CVSS 8.3 High · Not analysed yet · Published 28 May 2024 · Tags: Path traversal
- [Soot Infinite Loop vulnerability](https://agentprime.io/advisories/GHSA-hfg7-j82c-fr3w.md)
  `GHSA-hfg7-j82c-fr3w`, `CVE-2023-46442` · Maven `org.soot-oss:soot`: affected `<4.4.1`, fixed in `4.4.1` · CVSS 7.5 High · Not analysed yet · Published 24 May 2024 · Tags: Denial of service
- [Kwik does not discard unused encryption keys](https://agentprime.io/advisories/GHSA-w8cp-frxc-55pj.md)
  `GHSA-w8cp-frxc-55pj`, `CVE-2024-22588` · Maven `tech.kwik:kwik`: affected `<0.8`, fixed in `0.8` · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2024 · Tags: Weak cryptography or TLS, Denial of service
- [Jenkins Report Info Plugin Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-cw5r-jx8r-9f7x.md)
  `GHSA-cw5r-jx8r-9f7x`, `CVE-2024-5273` · Maven `org.jenkins-ci.plugins:report-info`: affected `<=1.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 24 May 2024 · Tags: Path traversal
- [Eclipse Ditto vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-hjfc-6jxr-j2rx.md)
  `GHSA-hjfc-6jxr-j2rx`, `CVE-2024-5165` · Maven `org.eclipse.ditto:ditto`: affected `>=3.0.0, <3.4.5 || >=3.5.0, <3.5.6`, fixed in `3.4.5`, `3.5.6` · CVSS 6.5 Medium · Not analysed yet · Published 23 May 2024 · Tags: Cross-site scripting (XSS)
- [Silverpeas Core vulnerable to Cross Site Scripting](https://agentprime.io/advisories/GHSA-9rrw-82r2-623p.md)
  `GHSA-9rrw-82r2-623p`, `CVE-2024-29392` · Maven `org.silverpeas.core:silverpeas-core`: affected `<=6.3`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 22 May 2024 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTA1LTIyVDE4OjMwOjQwLjAwMDAwMFoiLCJHSFNBLTlycnctODJyMi02MjNwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTA3LTE5VDA5OjMyOjA2LjAwMDAwMFoiLCJHSFNBLTRtZ2ctZnFmcS02NGhnIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTA3LTE5VDA5OjMyOjA2LjAwMDAwMFoiLCJHSFNBLTRtZ2ctZnFmcS02NGhnIl0>. Everything for agents: <https://agentprime.io/llms.txt>.