# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [XXE vulnerability in XSLT transforms in \`org.hl7.fhir.core\`](https://agentprime.io/advisories/GHSA-6cr6-ph3p-f5rf.md)
  `GHSA-6cr6-ph3p-f5rf`, `CVE-2024-45294` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` and 5 more: affected `<6.3.23`, fixed in `6.3.23` · CVSS 8.6 High · Not analysed yet · Published 6 Sept 2024 · Tags: XML external entities (XXE)
- [H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL](https://agentprime.io/advisories/GHSA-hrmc-jmp7-mpm2.md)
  `GHSA-hrmc-jmp7-mpm2`, `CVE-2024-45758`, `PYSEC-2026-352` · Maven `ai.h2o:h2o-core` and 1 more: affected `<=3.46.0.7`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2024 · Tags: Insecure deserialization
- [Vertx gRPC server does not limit the maximum message size](https://agentprime.io/advisories/GHSA-g76f-gjfx-4rpr.md)
  `GHSA-g76f-gjfx-4rpr`, `CVE-2024-8391` · Maven `io.vertx:vertx-grpc-client` and 1 more: affected `>=4.3.0, <4.5.10`, fixed in `4.5.10` · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2024 · Tags: Denial of service
- [Duplicate Advisory: Keycloak has a brute force login protection bypass](https://agentprime.io/advisories/GHSA-8wm9-24qg-m5qj.md)
  `GHSA-8wm9-24qg-m5qj` · Maven `org.keycloak:keycloak-services`: affected `<24.0.4`, fixed in `24.0.4` · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 3 Sept 2024 · Tags: CWE-837
- [Missing hostname validation in Kroxylicious](https://agentprime.io/advisories/GHSA-h83p-72jv-g7vp.md)
  `GHSA-h83p-72jv-g7vp`, `CVE-2024-8285` · Maven `io.kroxylicious:kroxylicious-runtime`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 5.9 Medium · Not analysed yet · Published 31 Aug 2024 · Tags: Weak cryptography or TLS
- [Signature forgery in Spring Boot's Loader](https://agentprime.io/advisories/GHSA-7cj3-x93g-gj76.md)
  `GHSA-7cj3-x93g-gj76`, `CVE-2024-38807` · Maven `org.springframework.boot:spring-boot-loader` and 1 more: affected `>=2.7.0, <2.7.22 || >=3.0.0, <3.0.17 || >=3.1.0, <3.1.13 || >=3.2.0, <3.2.9 || >=3.3.0, <3.3.3`, fixed in `2.7.22`, `3.0.17`, `3.1.13`, `3.2.9`, `3.3.3` · CVSS 6.3 Medium · Not analysed yet · Published 23 Aug 2024 · Tags: Authentication bypass, Weak cryptography or TLS
- [Undertow vulnerable to Race Condition](https://agentprime.io/advisories/GHSA-9623-mqmm-5rcf.md)
  `GHSA-9623-mqmm-5rcf`, `CVE-2024-7885` · Maven `io.undertow:undertow-core`: affected `<2.2.36.Final || >=2.3.0.Alpha1, <2.3.17.Final`, fixed in `2.2.36.Final`, `2.3.17.Final` · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2024 · Tags: Race condition
- [Apache SeaTunnel SQL Injection vulnerability](https://agentprime.io/advisories/GHSA-8m84-h9hh-3cfh.md)
  `GHSA-8m84-h9hh-3cfh`, `CVE-2023-49198` · Maven `org.apache.seatunnel:seatunnel`: affected `>=1.0.0, <1.0.1`, fixed in `1.0.1` · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2024 · Tags: Information disclosure
- [Apache Helix Front (UI) component contained a hard-coded secret](https://agentprime.io/advisories/GHSA-6247-7862-q2pq.md)
  `GHSA-6247-7862-q2pq`, `CVE-2024-22281` · Maven `org.apache.helix:helix`: affected `<=1.4.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2024 · Tags: Information disclosure
- [apollo-portal has potential unauthorized access issue](https://agentprime.io/advisories/GHSA-c6c3-h4f7-3962.md)
  `GHSA-c6c3-h4f7-3962`, `CVE-2024-43397` · Maven `com.ctrip.framework.apollo:apollo`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control
- [Spring Framework vulnerable to Denial of Service](https://agentprime.io/advisories/GHSA-9cmq-m9j5-mvww.md)
  `GHSA-9cmq-m9j5-mvww`, `CVE-2024-38808` · Maven `org.springframework:spring-expression`: affected `<5.3.39`, fixed in `5.3.39` · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Denial of service
- [Apache Dolphinscheduler Code Injection vulnerability](https://agentprime.io/advisories/GHSA-2fm6-mv57-p2qh.md)
  `GHSA-2fm6-mv57-p2qh`, `CVE-2024-43202` · Maven `org.apache.dolphinscheduler:dolphinscheduler-task-api`: affected `>=3.1.0, <3.2.2`, fixed in `3.2.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2024 · Tags: Code injection
- [Spring Security Missing Authorization vulnerability](https://agentprime.io/advisories/GHSA-hmqf-wpq9-jq83.md)
  `GHSA-hmqf-wpq9-jq83`, `CVE-2024-38810` · Maven `org.springframework.security:spring-security-core`: affected `>=6.3.0, <6.3.2`, fixed in `6.3.2` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Authentication bypass, Broken access control
- [In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them](https://agentprime.io/advisories/GHSA-f963-4cq8-2gw7.md)
  `GHSA-f963-4cq8-2gw7`, `CVE-2024-43401` · Maven `org.xwiki.platform:xwiki-platform-web-templates`: affected `<15.10-rc-1`, fixed in `15.10-rc-1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2024 · Tags: Privilege escalation, Broken access control
- [XWiki Platform allows XSS through XClass name in string properties](https://agentprime.io/advisories/GHSA-wcg9-pgqv-xm5v.md)
  `GHSA-wcg9-pgqv-xm5v`, `CVE-2024-43400` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=1.1.2, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.6 || >=16.0.0-rc-1, <16.0.0`, fixed in `14.10.21`, `15.5.5`, `15.10.6`, `16.0.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2024 · Tags: Cross-site scripting (XSS), Code injection
- [Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access](https://agentprime.io/advisories/GHSA-r6ph-5fp2-3w2v.md)
  `GHSA-r6ph-5fp2-3w2v`, `CVE-2024-44076` · Maven `io.github.microcks:microcks-app`: affected `<1.10.0`, fixed in `1.10.0` · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2024 · Tags: Privilege escalation, Broken access control
- [Silverpeas vulnerable to password complexity rule bypass](https://agentprime.io/advisories/GHSA-h6jq-w432-j26w.md)
  `GHSA-h6jq-w432-j26w`, `CVE-2024-42850` · Maven `org.silverpeas.core:silverpeas-core`: affected `<=6.4.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 16 Aug 2024 · Tags: Hard-coded credentials
- [Improper Preservation of Permissions in xxl-job](https://agentprime.io/advisories/GHSA-cpfp-m5qw-c4r3.md)
  `GHSA-cpfp-m5qw-c4r3`, `CVE-2024-42681` · Maven `com.xuxueli:xxl-job-core`: affected `<2.4.2`, fixed in `2.4.2` · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2024 · Tags: Broken access control, CWE-277, CWE-281
- [Apache MINA SSHD: integrity check bypass](https://agentprime.io/advisories/GHSA-2326-hx7g-3m9r.md)
  `GHSA-2326-hx7g-3m9r`, `CVE-2024-41909` · Maven `org.apache.sshd:sshd-common`: affected `<2.12.0`, fixed in `2.12.0` · CVSS 5.9 Medium · Not analysed yet · Published 12 Aug 2024 · Tags: CWE-354
- [Apache DolphinScheduler: RCE by arbitrary js execution](https://agentprime.io/advisories/GHSA-m9q4-p56m-mc6q.md)
  `GHSA-m9q4-p56m-mc6q`, `CVE-2024-29831` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `<3.2.2`, fixed in `3.2.2` · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2024 · Tags: CWE-20
- [Apache DolphinScheduler: Resource File Read And Write Vulnerability](https://agentprime.io/advisories/GHSA-4vv4-crw4-8pcw.md)
  `GHSA-4vv4-crw4-8pcw`, `CVE-2024-30188` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `>=3.1.0, <3.2.2`, fixed in `3.2.2` · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2024 · Tags: CWE-20
- [CometVisu Backend for openHAB has a path traversal vulnerability](https://agentprime.io/advisories/GHSA-pcwp-26pw-j98w.md)
  `GHSA-pcwp-26pw-j98w`, `CVE-2024-42468` · Maven `org.openhab.ui.bundles:org.openhab.ui.cometvisu`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: Path traversal
- [CometVisu Backend for openHAB affected by RCE through path traversal](https://agentprime.io/advisories/GHSA-f729-58x4-gqgf.md)
  `GHSA-f729-58x4-gqgf`, `CVE-2024-42469` · Maven `org.openhab.ui.bundles:org.openhab.ui.cometvisu`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2024 · Tags: Path traversal
- [CometVisu Backend for openHAB has a sensitive information disclosure vulnerability](https://agentprime.io/advisories/GHSA-3g4c-hjhr-73rj.md)
  `GHSA-3g4c-hjhr-73rj`, `CVE-2024-42470` · Maven `org.openhab.ui.bundles:org.openhab.ui.cometvisu`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 6.5 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: Broken access control
- [CometVisu Backend for openHAB affected by SSRF/XSS](https://agentprime.io/advisories/GHSA-v7gr-mqpj-wwh3.md)
  `GHSA-v7gr-mqpj-wwh3`, `CVE-2024-42467` · Maven `org.openhab.ui.bundles:org.openhab.ui.cometvisu`: affected `>=3.4.0.M4, <4.2.1`, fixed in `4.2.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2024 · Tags: Server-side request forgery (SSRF)
- [Jenkins Remoting library arbitrary file read vulnerability](https://agentprime.io/advisories/GHSA-h856-ffvv-xvr4.md)
  `GHSA-h856-ffvv-xvr4`, `BIT-jenkins-2024-43044`, `CVE-2024-43044` · Maven `org.jenkins-ci.main:jenkins-core` and 1 more: affected `<2.452.4 || >=2.460, <2.462.1 || >=2.470, <2.471`, fixed in `2.452.4`, `2.462.1`, `2.471` · CVSS 9.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 7 Aug 2024 · Tags: Path traversal, CWE-754
- [Jenkins does not perform a permission check in an HTTP endpoint](https://agentprime.io/advisories/GHSA-8pv9-qh96-9hc6.md)
  `GHSA-8pv9-qh96-9hc6`, `BIT-jenkins-2024-43045`, `CVE-2024-43045` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.452.4 || >=2.460, <2.462.1 || >=2.470, <2.471`, fixed in `2.452.4`, `2.462.1`, `2.471` · CVSS 5.4 Medium · Not analysed yet · Published 7 Aug 2024 · Tags: Broken access control
- [Duplicate Advisory: Reposilite Arbitrary File Read vulnerability](https://agentprime.io/advisories/GHSA-w7c4-5w4f-jm3g.md)
  `GHSA-w7c4-5w4f-jm3g`, `CVE-2024-36117` · Maven `com.reposilite:reposilite-backend`: affected `>=3.3.0, <3.5.12`, fixed in `3.5.12` · CVSS 8.6 High · Withdrawn · Not analysed yet · Published 5 Aug 2024 · Tags: Path traversal
- [XXL-RPC Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-f984-3wx8-grp9.md)
  `GHSA-f984-3wx8-grp9`, `CVE-2023-45146` · Maven `com.xuxueli:xxl-rpc-core`: affected `<=1.7.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2024 · Tags: Insecure deserialization
- [Redisson vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-4hvc-qwr2-f8rv.md)
  `GHSA-4hvc-qwr2-f8rv`, `CVE-2023-42809` · Maven `org.redisson:redisson`: affected `<3.22.0`, fixed in `3.22.0` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2024 · Tags: Insecure deserialization
- [Apereo CAS vulnerable to credential leaks for LDAP authentication](https://agentprime.io/advisories/GHSA-p78h-m8pv-g9gm.md)
  `GHSA-p78h-m8pv-g9gm`, `CVE-2023-28857` · Maven `org.apereo.cas:cas-server-support-x509-core`: affected `>=6.5.0, <6.6.6`, fixed in `6.6.6` · CVSS 4.0 Medium · Not analysed yet · Published 5 Aug 2024 · Tags: Information disclosure, Hard-coded credentials
- [Alpine allows Authentication Filter bypass](https://agentprime.io/advisories/GHSA-whr2-9x5f-5c79.md)
  `GHSA-whr2-9x5f-5c79`, `CVE-2022-23554` · Maven `us.springett:alpine`: affected `<1.10.4`, fixed in `1.10.4` · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2024 · Tags: Authentication bypass, CWE-697
- [Alpine allows URL access filter bypass](https://agentprime.io/advisories/GHSA-2w4p-2hf7-gh8x.md)
  `GHSA-2w4p-2hf7-gh8x`, `CVE-2022-23553` · Maven `us.springett:alpine`: affected `<1.10.4`, fixed in `1.10.4` · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2024 · Tags: Broken access control
- [Path traversal in Reposilite javadoc file expansion (arbitrary file creation/overwrite) (\`GHSL-2024-073\`)](https://agentprime.io/advisories/GHSA-frvj-cfq4-3228.md)
  `GHSA-frvj-cfq4-3228`, `CVE-2024-36116` · Maven `com.reposilite:reposilite-backend`: affected `>=3.3.0, <3.5.12`, fixed in `3.5.12` · CVSS 7.5 High · Not analysed yet · Published 2 Aug 2024 · Tags: Path traversal
- [Reposilite artifacts vulnerable to Stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-9w8w-34vr-65j2.md)
  `GHSA-9w8w-34vr-65j2`, `CVE-2024-36115` · Maven `com.reposilite:reposilite-backend`: affected `>=3.3.0, <3.5.12`, fixed in `3.5.12` · CVSS 7.1 High · Not analysed yet · Published 2 Aug 2024 · Tags: Cross-site scripting (XSS)
- [Apache Linkis vulnerable to privilege escalation](https://agentprime.io/advisories/GHSA-v352-rg37-5q5m.md)
  `GHSA-v352-rg37-5q5m`, `CVE-2024-27181` · Maven `org.apache.linkis:linkis`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 2 Aug 2024 · Tags: Privilege escalation
- [Apache Inlong Code Injection vulnerability](https://agentprime.io/advisories/GHSA-qff2-8qw7-hcvw.md)
  `GHSA-qff2-8qw7-hcvw`, `CVE-2024-36268` · Maven `org.apache.inlong:tubemq-core`: affected `>=1.10.0, <1.13.0`, fixed in `1.13.0` · CVSS 7.6 High · Not analysed yet · Published 2 Aug 2024 · Tags: Code injection
- [Apache Linkis arbitrary file deletion vulnerability](https://agentprime.io/advisories/GHSA-j6vx-r77h-44wc.md)
  `GHSA-j6vx-r77h-44wc`, `CVE-2024-27182` · Maven `org.apache.linkis:linkis`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 4.9 Medium · Not analysed yet · Published 2 Aug 2024 · Tags: Information disclosure
- [biscuit-java vulnerable to public key confusion in third party block](https://agentprime.io/advisories/GHSA-5hcj-rwm6-xmw4.md)
  `GHSA-5hcj-rwm6-xmw4`, `CVE-2024-41948` · Maven `org.biscuitsec:biscuit`: affected `>=3.0.0, <4.0.0`, fixed in `4.0.0` · CVSS 3.0 Low · Not analysed yet · Published 31 Jul 2024 · Tags: CWE-1259
- [Elasticsearch stores private key on disk unencrypted](https://agentprime.io/advisories/GHSA-5v8f-xx9m-wj44.md)
  `GHSA-5v8f-xx9m-wj44`, `BIT-elasticsearch-2024-23444`, `CVE-2024-23444` · Maven `org.elasticsearch:elasticsearch`: affected `>=8.0.0-alpha1, <8.13.0 || <7.17.23`, fixed in `8.13.0`, `7.17.23` · CVSS 4.9 Medium · Not analysed yet · Published 31 Jul 2024 · Tags: Weak cryptography or TLS
- [XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution](https://agentprime.io/advisories/GHSA-692v-783f-mg8x.md)
  `GHSA-692v-783f-mg8x`, `CVE-2024-41947` · Maven `org.xwiki.platform:xwiki-platform-web-templates`: affected `>=11.8-rc-1, <15.10.8 || >=16.0.0-rc-1, <16.3.0-rc-1`, fixed in `15.10.8`, `16.3.0-rc-1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2024 · Tags: Cross-site scripting (XSS)
- [XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet](https://agentprime.io/advisories/GHSA-h63h-5c77-77p5.md)
  `GHSA-h63h-5c77-77p5`, `CVE-2024-37901` · Maven `org.xwiki.platform:xwiki-platform-search-ui`: affected `>=9.2-rc-1, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.2`, fixed in `14.10.21`, `15.5.5`, `15.10.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2024 · Tags: Code injection, Broken access control
- [XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader](https://agentprime.io/advisories/GHSA-wf3x-jccf-5g5g.md)
  `GHSA-wf3x-jccf-5g5g`, `CVE-2024-37900` · Maven `org.xwiki.platform:xwiki-platform-web-war`: affected `>=4.2-milestone-3, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.6 || >=16.0.0-rc-1, <16.0.0`, fixed in `14.10.21`, `15.5.5`, `15.10.6`, `16.0.0` · CVSS 6.4 Medium · EPSS 0.16 · Not analysed yet · Published 31 Jul 2024 · Tags: Code injection
- [XWiki Platform vulnerable to document deletion and overwrite from edit](https://agentprime.io/advisories/GHSA-33gp-gmg3-hfpq.md)
  `GHSA-33gp-gmg3-hfpq`, `CVE-2024-37898` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=13.10.4, <14.10.21 || >=14.2, <14.10.21 || >=15.0, <15.5.5 || >=15.6-rc-1, <15.10.6`, fixed in `14.10.21`, `15.5.5`, `15.10.6` · CVSS 4.3 Medium · Not analysed yet · Published 31 Jul 2024 · Tags: Broken access control
- [Apache SeaTunnel Web Authentication vulnerability](https://agentprime.io/advisories/GHSA-cp2c-x2pc-fph7.md)
  `GHSA-cp2c-x2pc-fph7`, `CVE-2023-48396` · Maven `org.apache.seatunnel:seatunnel-web`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 8.2 High · Not analysed yet · Published 30 Jul 2024 · Tags: Authentication bypass
- [GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service](https://agentprime.io/advisories/GHSA-h9mq-f6q5-6c8m.md)
  `GHSA-h9mq-f6q5-6c8m`, `CVE-2024-40094` · Maven `com.graphql-java:graphql-java`: affected `<19.11 || >=20.0, <20.9 || >=21.0, <21.5`, fixed in `19.11`, `20.9`, `21.5` · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2024 · Tags: Denial of service
- [Elasticsearch Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/GHSA-2hjr-vmf3-xwvp.md)
  `GHSA-2hjr-vmf3-xwvp`, `BIT-elasticsearch-2023-49921`, `CVE-2023-49921` · Maven `org.elasticsearch:elasticsearch`: affected `<7.17.16 || >=8.0.0, <8.11.2`, fixed in `7.17.16`, `8.11.2` · CVSS 5.2 Medium · Not analysed yet · Published 26 Jul 2024 · Tags: Information disclosure
- [OpenAM FreeMarker template injection](https://agentprime.io/advisories/GHSA-7726-43hg-m23v.md)
  `GHSA-7726-43hg-m23v`, `CVE-2024-41667` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `<15.0.4`, fixed in `15.0.4` · CVSS 8.8 High · Not analysed yet · Published 25 Jul 2024 · Tags: Code injection
- [Remote code execution in Spring Cloud Data Flow](https://agentprime.io/advisories/GHSA-p528-3mvf-gr87.md)
  `GHSA-p528-3mvf-gr87`, `BIT-spring-cloud-dataflow-2024-37084`, `CVE-2024-37084` · Maven `org.springframework.cloud:spring-cloud-skipper`: affected `<2.11.4`, fixed in `2.11.4` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 25 Jul 2024 · Tags: Path traversal, Code injection
- [XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill](https://agentprime.io/advisories/GHSA-v62g-jwj9-rfvx.md)
  `GHSA-v62g-jwj9-rfvx`, `CVE-2023-48362` · Maven `org.apache.drill.exec:drill-java-exec`: affected `>=1.19.0, <1.21.2`, fixed in `1.21.2` · CVSS 8.8 High · Not analysed yet · Published 24 Jul 2024 · Tags: XML external entities (XXE)
- [Apache Pinot: Unauthorized endpoint exposed sensitive information](https://agentprime.io/advisories/GHSA-8gj9-r4hv-3jjw.md)
  `GHSA-8gj9-r4hv-3jjw`, `CVE-2024-39676` · Maven `org.apache.pinot:pinot-controller`: affected `>=0.1, <1.0.0`, fixed in `1.0.0` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2024 · Tags: Information disclosure
- [DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks](https://agentprime.io/advisories/GHSA-crjg-w57m-rqqf.md)
  `GHSA-crjg-w57m-rqqf` · Maven `dnsjava:dnsjava` and 1 more: affected `>=3.5.0, <3.6.0`, fixed in `3.6.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: Denial of service
- [DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources](https://agentprime.io/advisories/GHSA-mmwx-rj87-vfgr.md)
  `GHSA-mmwx-rj87-vfgr` · Maven `dnsjava:dnsjava` and 1 more: affected `>=3.5.0, <3.6.0`, fixed in `3.6.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: Denial of service
- [DNSJava DNSSEC Bypass](https://agentprime.io/advisories/GHSA-cfxw-4h78-h7fw.md)
  `GHSA-cfxw-4h78-h7fw`, `CVE-2024-25638` · Maven `dnsjava:dnsjava`: affected `<3.6.0`, fixed in `3.6.0` · CVSS 8.9 High · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-345, CWE-349
- [Apache Syncope Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-8pxv-x6jq-5vw9.md)
  `GHSA-8pxv-x6jq-5vw9`, `CVE-2024-38503` · Maven `org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui` and 1 more: affected `>=2.1.0, <3.0.8`, fixed in `3.0.8` · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: Cross-site scripting (XSS), CWE-20
- [Apache RocketMQ Vulnerable to Unauthorized Exposure of Sensitive Data](https://agentprime.io/advisories/GHSA-q9w2-h4cw-8ghp.md)
  `GHSA-q9w2-h4cw-8ghp`, `CVE-2024-23321` · Maven `org.apache.rocketmq:rocketmq-all`: affected `>=4.5.2, <5.3.0`, fixed in `5.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: Information disclosure
- [H2O vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-w36w-948j-xhfw.md)
  `GHSA-w36w-948j-xhfw`, `CVE-2024-6960` · Maven `ai.h2o:h2o-core`: affected `<=3.46.0.4`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2024 · Tags: Insecure deserialization
- [Apache CXF Denial of Service vulnerability in JOSE](https://agentprime.io/advisories/GHSA-6pff-fmh2-4mmf.md)
  `GHSA-6pff-fmh2-4mmf`, `CVE-2024-32007` · Maven `org.apache.cxf:cxf-rt-rs-security-jose`: affected `>=4.0.0, <4.0.5 || >=3.6.0, <3.6.4 || <3.5.9`, fixed in `4.0.5`, `3.6.4`, `3.5.9` · CVSS 5.3 Medium · Not analysed yet · Published 19 Jul 2024 · Tags: Denial of service, CWE-20
- [Apache CXF: SSRF vulnerability via WADL stylesheet parameter](https://agentprime.io/advisories/GHSA-5m3j-pxh7-455p.md)
  `GHSA-5m3j-pxh7-455p`, `CVE-2024-29736` · Maven `org.apache.cxf:cxf-rt-rs-service-description`: affected `>=4.0.0, <4.0.5 || >=3.6.0, <3.6.4 || <3.5.9`, fixed in `4.0.5`, `3.6.4`, `3.5.9` · CVSS 5.9 Medium · Not analysed yet · Published 19 Jul 2024 · Tags: Server-side request forgery (SSRF)
- [Apache CXF allows unrestricted memory consumption in CXF HTTP clients](https://agentprime.io/advisories/GHSA-4mgg-fqfq-64hg.md)
  `GHSA-4mgg-fqfq-64hg`, `CVE-2024-41172` · Maven `org.apache.cxf:cxf-rt-transports-http`: affected `>=4.0.0, <4.0.5 || >=3.6.0, <3.6.4`, fixed in `4.0.5`, `3.6.4` · CVSS 3.7 Low · Not analysed yet · Published 19 Jul 2024 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTA3LTE5VDA5OjMyOjA2LjAwMDAwMFoiLCJHSFNBLTRtZ2ctZnFmcS02NGhnIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTA5LTA5VDIxOjMxOjIyLjAwMDAwMFoiLCJHSFNBLTU3cmgtZ3I0di1qNWY2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTA5LTA5VDIxOjMxOjIyLjAwMDAwMFoiLCJHSFNBLTU3cmgtZ3I0di1qNWY2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.