# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Path traversal vulnerability in Jenkins Matrix Project Plugin](https://agentprime.io/advisories/GHSA-cjgm-9vc9-56mx.md)
  `GHSA-cjgm-9vc9-56mx`, `CVE-2024-23900` · Maven `org.jenkins-ci.plugins:matrix-project`: affected `<822.824.v14451b`, fixed in `822.824.v14451b` · CVSS 4.6 Medium · Not analysed yet · Published 24 Jan 2024 · Tags: Path traversal
- [CSRF vulnerability in Jenkins GitLab Branch Source Plugin](https://agentprime.io/advisories/GHSA-8r93-59cf-358f.md)
  `GHSA-8r93-59cf-358f`, `CVE-2024-23902` · Maven `io.jenkins.plugins:gitlab-branch-source`: affected `<688.v5fa`, fixed in `688.v5fa` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jan 2024 · Tags: Cross-site request forgery (CSRF)
- [Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE](https://agentprime.io/advisories/GHSA-6f9g-cxwr-q5jr.md)
  `GHSA-6f9g-cxwr-q5jr`, `BIT-jenkins-2024-23897`, `CVE-2024-23897` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=1.606, <2.426.3 || >=2.427, <2.440.1 || >=2.441, <2.442`, fixed in `2.426.3`, `2.440.1`, `2.442` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 24 Jan 2024 · Tags: Path traversal, CWE-27
- [Cross-site WebSocket hijacking vulnerability in the Jenkins CLI](https://agentprime.io/advisories/GHSA-53ph-2r2x-vqw8.md)
  `GHSA-53ph-2r2x-vqw8`, `BIT-jenkins-2024-23898`, `CVE-2024-23898` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.217, <2.426.3 || >=2.427, <2.442`, fixed in `2.426.3`, `2.442` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.67 · Not analysed yet · Published 24 Jan 2024 · Tags: CWE-346
- [Cross-site Scripting in JFinal](https://agentprime.io/advisories/GHSA-qh2w-9m7w-hjg2.md)
  `GHSA-qh2w-9m7w-hjg2`, `CVE-2024-22497` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 23 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Remote Command Execution in SOFARPC](https://agentprime.io/advisories/GHSA-7q8p-9953-pxvr.md)
  `GHSA-7q8p-9953-pxvr`, `CVE-2024-23636` · Maven `com.alipay.sofa:rpc-sofa-boot-starter`: affected `<5.12.0`, fixed in `5.12.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2024 · Tags: Insecure deserialization
- [Cross-site Scripting in beetl-bbs](https://agentprime.io/advisories/GHSA-v9wr-2xrg-v7w8.md)
  `GHSA-v9wr-2xrg-v7w8`, `CVE-2024-22490` · Maven `com.ibeetl:beetl`: affected `<=2.0.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 23 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in JFinal](https://agentprime.io/advisories/GHSA-v435-pfj6-68r3.md)
  `GHSA-v435-pfj6-68r3`, `CVE-2024-22496` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 23 Jan 2024 · Tags: Cross-site scripting (XSS)
- [keycloak-core: open redirect via "form_post.jwt" JARM response mode](https://agentprime.io/advisories/GHSA-9vm7-v8wj-3fqw.md)
  `GHSA-9vm7-v8wj-3fqw`, `CVE-2023-6927` · Maven `org.keycloak:keycloak-core`: affected `<23.0.4`, fixed in `23.0.4` · CVSS 4.6 Medium · Not analysed yet · Published 23 Jan 2024 · Tags: Open redirect
- [Spring Framework server Web DoS Vulnerability](https://agentprime.io/advisories/GHSA-r4q3-7g4q-x89m.md)
  `GHSA-r4q3-7g4q-x89m`, `CVE-2024-22233` · Maven `org.springframework:spring-core`: affected `>=6.1.2, <6.1.3 || >=6.0.15, <6.0.16`, fixed in `6.1.3`, `6.0.16` · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2024 · Tags: Denial of service
- [Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization](https://agentprime.io/advisories/GHSA-jgxc-8mwq-9xqw.md)
  `GHSA-jgxc-8mwq-9xqw`, `CVE-2017-20189` · Maven `org.clojure:clojure`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2024 · Tags: Insecure deserialization
- [Duplicate Advisory: Discovery uses the same AES/GCM Nonce throughout the session](https://agentprime.io/advisories/GHSA-wp4m-7hpj-8qp8.md)
  `GHSA-wp4m-7hpj-8qp8` · Maven `tech.pegasys.discovery:discovery`: affected `<0.4.5`, fixed in `0.4.5` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 20 Jan 2024 · Tags: Weak cryptography or TLS, CWE-323
- [Insertion of Sensitive Information into Log File in OWASP DependencyCheck](https://agentprime.io/advisories/GHSA-frxm-v7q3-v2wv.md)
  `GHSA-frxm-v7q3-v2wv`, `CVE-2024-23686`, `GHSA-qqhq-8r2c-c3f5` · Maven `org.owasp:dependency-check-ant` and 2 more: affected `>=9.0.0, <9.0.6`, fixed in `9.0.6` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jan 2024 · Tags: Information disclosure
- [Duplicate Advisory: Hard-coded credentials in org.folio:mod-data-export-spring](https://agentprime.io/advisories/GHSA-9rhq-86fm-qxqc.md)
  `GHSA-9rhq-86fm-qxqc` · Maven `org.folio:mod-data-export-spring`: affected `<1.5.4 || >=2.0.0, <3.0.0`, fixed in `1.5.4`, `3.0.0` · CVSS 9.1 Critical · Withdrawn · Not analysed yet · Published 20 Jan 2024 · Tags: Hard-coded credentials
- [Duplicate Advisory: Hard-coded credentials in org.folio:mod-remote-storage](https://agentprime.io/advisories/GHSA-hv5g-q4h3-64q4.md)
  `GHSA-hv5g-q4h3-64q4` · Maven `org.folio:mod-remote-storage`: affected `>=2.0.0, <2.0.3 || <1.7.2`, fixed in `2.0.3`, `1.7.2` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Hard-coded credentials
- [Duplicate Advisory: JavaScript execution via malicious molfiles (XSS)](https://agentprime.io/advisories/GHSA-wc6f-qjxc-622v.md)
  `GHSA-wc6f-qjxc-622v` · Maven `de.ipb-halle:molecularfaces`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 6.1 Medium · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox](https://agentprime.io/advisories/GHSA-hj55-9jmv-9jrj.md)
  `GHSA-hj55-9jmv-9jrj` · Maven `de.tum.in.ase:artemis-java-test-sandbox`: affected `<1.8.0`, fixed in `1.8.0` · CVSS 8.2 High · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: CWE-501
- [Duplicate Advisory: Inefficient Algorithmic Complexity in com.upokecenter:cbor](https://agentprime.io/advisories/GHSA-hfj8-63c8-rmfw.md)
  `GHSA-hfj8-63c8-rmfw` · Maven `com.upokecenter:cbor`: affected `>=4.0.0, <4.5.1`, fixed in `4.5.1` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Denial of service
- [Duplicate Advisory: Improper Verification of Cryptographic Signature in aws-encryption-sdk-java](https://agentprime.io/advisories/GHSA-gvc7-gjrw-hj65.md)
  `GHSA-gvc7-gjrw-hj65` · Maven `com.amazonaws:aws-encryption-sdk-java`: affected `<1.9.0 || >=2.0.0, <2.2.0`, fixed in `1.9.0`, `2.2.0` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Weak cryptography or TLS
- [Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox](https://agentprime.io/advisories/GHSA-c4pg-5ggh-vcpp.md)
  `GHSA-c4pg-5ggh-vcpp` · Maven `de.tum.in.ase:artemis-java-test-sandbox`: affected `<1.11.2`, fixed in `1.11.2` · CVSS 8.2 High · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Code injection, Broken access control
- [Duplicate Advisory: Session fixation in Enonic XP](https://agentprime.io/advisories/GHSA-4hrp-m3f2-643j.md)
  `GHSA-4hrp-m3f2-643j` · Maven `com.enonic.xp:lib-auth`: affected `<7.7.4`, fixed in `7.7.4` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Authentication bypass
- [Duplicate Advisory: Exposure of sensitive information in ClickHouse](https://agentprime.io/advisories/GHSA-3p77-wg4c-qm24.md)
  `GHSA-3p77-wg4c-qm24` · Maven `com.clickhouse:clickhouse-client` and 2 more: affected `<0.4.6`, fixed in `0.4.6` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Information disclosure
- [Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox](https://agentprime.io/advisories/GHSA-23rx-79r7-6cpx.md)
  `GHSA-23rx-79r7-6cpx` · Maven `de.tum.in.ase:artemis-java-test-sandbox`: affected `<1.7.6`, fixed in `1.7.6` · CVSS 8.2 High · Withdrawn · Not analysed yet · Published 19 Jan 2024
- [Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information](https://agentprime.io/advisories/GHSA-f4qf-m5gf-8jm8.md)
  `GHSA-f4qf-m5gf-8jm8`, `BIT-tomcat-2024-21733`, `CVE-2024-21733` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=8.5.7, <8.5.64 || >=9.0.0-M11, <9.0.44`, fixed in `8.5.64`, `9.0.44` · CVSS 5.3 Medium · EPSS 0.14 · Not analysed yet · Published 19 Jan 2024 · Tags: Information disclosure
- [Stored Cross Site Scripting in beetl-bbs](https://agentprime.io/advisories/GHSA-32q4-86g8-6637.md)
  `GHSA-32q4-86g8-6637`, `CVE-2024-22491` · Maven `com.ibeetl:beetl`: affected `<=2.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 16 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Code injection in mingSoft MCMS](https://agentprime.io/advisories/GHSA-h57w-vh34-f8cw.md)
  `GHSA-h57w-vh34-f8cw`, `CVE-2023-51282` · Maven `net.mingsoft:ms-mcms`: affected `<=5.2.4`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 16 Jan 2024 · Tags: Code injection
- [Apache Shiro vulnerable to path traversal](https://agentprime.io/advisories/GHSA-jc7h-c423-mpjc.md)
  `GHSA-jc7h-c423-mpjc`, `CVE-2023-46749` · Maven `org.apache.shiro:shiro-core`: affected `<1.13.0 || >=2.0.0alpha1, <2.0.0-alpha4`, fixed in `1.13.0`, `2.0.0-alpha4` · CVSS 6.5 Medium · Not analysed yet · Published 15 Jan 2024 · Tags: Path traversal
- [Apache Solr allows read access to host environmet variables](https://agentprime.io/advisories/GHSA-gg7w-pw2r-x2cq.md)
  `GHSA-gg7w-pw2r-x2cq`, `BIT-solr-2023-50290`, `CVE-2023-50290` · Maven `org.apache.solr:solr-core`: affected `>=9.0.0, <9.3.0`, fixed in `9.3.0` · CVSS 6.5 Medium · EPSS 0.68 · Not analysed yet · Published 15 Jan 2024 · Tags: Information disclosure
- [Cross-site Scripting in JFinal](https://agentprime.io/advisories/GHSA-859h-4w58-78xw.md)
  `GHSA-859h-4w58-78xw`, `CVE-2024-22492` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 12 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in JFinal](https://agentprime.io/advisories/GHSA-3j4x-9q9q-3277.md)
  `GHSA-3j4x-9q9q-3277`, `CVE-2024-22493` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 12 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Qualys Jenkins Plugin for Policy Compliance Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-rwf9-8fqr-p44m.md)
  `GHSA-rwf9-8fqr-p44m`, `CVE-2023-6148` · Maven `com.qualys.plugins:qualys-pc`: affected `<1.0.6`, fixed in `1.0.6` · CVSS 5.7 Medium · Not analysed yet · Published 9 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability](https://agentprime.io/advisories/GHSA-8525-52vg-jv6v.md)
  `GHSA-8525-52vg-jv6v`, `CVE-2023-6147` · Maven `com.qualys.plugins:qualys-pc`: affected `<1.0.6`, fixed in `1.0.6` · CVSS 5.7 Medium · Not analysed yet · Published 9 Jan 2024 · Tags: XML external entities (XXE)
- [Qualys Jenkins Plugin for WAS XML External Entity vulnerability](https://agentprime.io/advisories/GHSA-5gwh-r76w-934h.md)
  `GHSA-5gwh-r76w-934h`, `CVE-2023-6149` · Maven `com.qualys.plugins:qualys-was`: affected `<2.0.12`, fixed in `2.0.12` · CVSS 5.7 Medium · Not analysed yet · Published 9 Jan 2024 · Tags: XML external entities (XXE)
- [XWiki vulnerable to Denial of Service attack through attachments](https://agentprime.io/advisories/GHSA-8959-rfxh-r4j4.md)
  `GHSA-8959-rfxh-r4j4`, `CVE-2024-21651` · Maven `org.xwiki.platform:xwiki-platform-distribution-war`: affected `>=14.10, <14.10.18 || >=15.0-rc-1, <15.5.3 || >=15.6-rc-1, <15.8-rc-1`, fixed in `14.10.18`, `15.5.3`, `15.8-rc-1` · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2024 · Tags: Denial of service
- [XWiki Remote Code Execution Vulnerability via User Registration](https://agentprime.io/advisories/GHSA-rj7p-xjv7-7229.md)
  `GHSA-rj7p-xjv7-7229`, `CVE-2024-21650` · Maven `org.xwiki.platform:xwiki-platform-administration-ui`: affected `>=2.2, <14.10.17 || >=15.0-rc-1, <15.5.3 || >=15.6-rc-1, <15.8-rc-1`, fixed in `14.10.17`, `15.5.3`, `15.8-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.93 · Not analysed yet · Published 8 Jan 2024 · Tags: Code injection
- [XWiki has no right protection on rollback action](https://agentprime.io/advisories/GHSA-xh35-w7wg-95v3.md)
  `GHSA-xh35-w7wg-95v3`, `CVE-2024-21648` · Maven `org.xwiki.platform:xwiki-platform` and 1 more: affected `>=15.0-rc-1, <15.5.3 || >=15.6-rc-1, <15.8-rc-1`, fixed in `15.5.3`, `15.8-rc-1` · CVSS 8.0 High · Not analysed yet · Published 8 Jan 2024 · Tags: CWE-274
- [Apache Axis Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-hr2c-p8rh-238h.md)
  `GHSA-hr2c-p8rh-238h`, `CVE-2023-51441` · Maven `axis:axis` and 1 more: affected `<=1.3`, no fixed version yet · CVSS 7.2 High · Not analysed yet · Published 6 Jan 2024 · Tags: Server-side request forgery (SSRF), CWE-20
- [Ion Java StackOverflow vulnerability](https://agentprime.io/advisories/GHSA-264p-99wq-f4j6.md)
  `GHSA-264p-99wq-f4j6`, `CVE-2024-21634` · Maven `com.amazon.ion:ion-java` and 1 more: affected `<1.10.5`, fixed in `1.10.5` · CVSS 7.5 High · Not analysed yet · Published 3 Jan 2024 · Tags: Denial of service
- [Apache InLong Manager Arbitrary File Read Vulnerability](https://agentprime.io/advisories/GHSA-crwj-2r3c-gx2g.md)
  `GHSA-crwj-2r3c-gx2g`, `CVE-2023-51785` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.5.0, <1.10.0`, fixed in `1.10.0` · CVSS 7.5 High · Not analysed yet · Published 3 Jan 2024 · Tags: Insecure deserialization
- [Apache InLong Manager Remote Code Execution vulnerability](https://agentprime.io/advisories/GHSA-9xg9-hh45-xcm6.md)
  `GHSA-9xg9-hh45-xcm6`, `CVE-2023-51784` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.5.0, <1.10.0`, fixed in `1.10.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jan 2024 · Tags: Code injection
- [Apache DolphinScheduler: Arbitrary js execute as root for authenticated users](https://agentprime.io/advisories/GHSA-v7hg-77v9-2445.md)
  `GHSA-v7hg-77v9-2445`, `CVE-2023-49299` · Maven `org.apache.dolphinscheduler:dolphinscheduler-master`: affected `<3.1.9`, fixed in `3.1.9` · CVSS 8.8 High · Not analysed yet · Published 30 Dec 2023 · Tags: CWE-20
- [Mingsoft MCMS SQL injection](https://agentprime.io/advisories/GHSA-3vvh-8c65-32j4.md)
  `GHSA-3vvh-8c65-32j4`, `CVE-2023-50578` · Maven `net.mingsoft:ms-mcms`: affected `<=5.2.9`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 30 Dec 2023 · Tags: SQL injection
- [JeecgBoot server-side template injection](https://agentprime.io/advisories/GHSA-49jp-cghc-p5pj.md)
  `GHSA-49jp-cghc-p5pj`, `CVE-2023-41544` · Maven `org.jeecgframework.boot:jeecg-boot-common`: affected `<=3.5.3`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2023 · Tags: Code injection
- [Jeecg Boot SQL Injection](https://agentprime.io/advisories/GHSA-fr29-w6j4-525f.md)
  `GHSA-fr29-w6j4-525f`, `CVE-2023-41543` · Maven `org.jeecgframework.boot:jeecg-boot-common`: affected `<=3.5.3`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2023 · Tags: SQL injection
- [Jeecg Boot SQL injection vulnerability](https://agentprime.io/advisories/GHSA-5v9r-788c-wc8p.md)
  `GHSA-5v9r-788c-wc8p`, `CVE-2023-41542` · Maven `org.jeecgframework.boot:jeecg-boot-common`: affected `<=3.5.3`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2023 · Tags: SQL injection
- [Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions](https://agentprime.io/advisories/GHSA-r4w2-hjmr-36m7.md)
  `GHSA-r4w2-hjmr-36m7`, `CVE-2023-3629` · Maven `org.infinispan:infinispan-server-rest`: affected `>=15.0.0.Dev01, <15.0.0.Dev04 || <14.0.18.Final`, fixed in `15.0.0.Dev04`, `14.0.18.Final` · CVSS 4.3 Medium · Not analysed yet · Published 30 Dec 2023 · Tags: Authentication bypass
- [Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions](https://agentprime.io/advisories/GHSA-fhr7-8jx4-r9cp.md)
  `GHSA-fhr7-8jx4-r9cp`, `CVE-2023-3628` · Maven `org.infinispan:infinispan-server-rest`: affected `>=15.0.0.Dev01, <15.0.0.Dev04 || <14.0.18.Final`, fixed in `15.0.0.Dev04`, `14.0.18.Final` · CVSS 6.5 Medium · Not analysed yet · Published 30 Dec 2023 · Tags: Authentication bypass
- [IPAddress Infinite Loop vulnerability (Disputed)](https://agentprime.io/advisories/GHSA-qphf-w3cq-jpmx.md)
  `GHSA-qphf-w3cq-jpmx`, `CVE-2023-50570` · Maven `com.github.seancfoley:ipaddress`: affected `<=5.4.0`, no fixed version yet · CVSS 5.5 Medium · Withdrawn · Not analysed yet · Published 29 Dec 2023 · Tags: Denial of service
- [easy-rules-mvel vulnerable to remote code execution](https://agentprime.io/advisories/GHSA-fgwc-3j6w-ch22.md)
  `GHSA-fgwc-3j6w-ch22`, `CVE-2023-50571` · Maven `org.jeasy:easy-rules-mvel`: affected `=4.1.0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 29 Dec 2023
- [JLine vulnerable to out of memory error](https://agentprime.io/advisories/GHSA-2268-98wh-qfhf.md)
  `GHSA-2268-98wh-qfhf`, `CVE-2023-50572` · Maven `org.jline:jline-parent`: affected `<3.25.0`, fixed in `3.25.0` · CVSS 5.5 Medium · Not analysed yet · Published 29 Dec 2023 · Tags: Memory corruption
- [ShifuML shifu code injection vulnerability](https://agentprime.io/advisories/GHSA-5fpq-3c9p-3r3w.md)
  `GHSA-5fpq-3c9p-3r3w`, `CVE-2023-7148` · Maven `ml.shifu:shifu`: affected `<=0.12.0`, no fixed version yet · CVSS 5.0 Medium · Not analysed yet · Published 29 Dec 2023 · Tags: Code injection
- [Infinispan circular object references causes out of memory errors](https://agentprime.io/advisories/GHSA-488m-w9fp-5mm2.md)
  `GHSA-488m-w9fp-5mm2`, `CVE-2023-5236` · Maven `org.infinispan.protostream:protostream`: affected `<4.6.2.Final`, fixed in `4.6.2.Final` · CVSS 4.4 Medium · Not analysed yet · Published 28 Dec 2023 · Tags: CWE-1047
- [Infinispan caches credentials in clear text](https://agentprime.io/advisories/GHSA-gg57-587f-h5v6.md)
  `GHSA-gg57-587f-h5v6`, `CVE-2023-5384` · Maven `org.infinispan:infinispan-cachestore-jdbc` and 7 more: affected `>=15.0.0.Dev01, <15.0.0.Dev07 || <14.0.25.Final`, fixed in `15.0.0.Dev07`, `14.0.25.Final` · CVSS 7.2 High · Not analysed yet · Published 28 Dec 2023 · Tags: Information disclosure
- [hyavijava stack overflow vulnerability](https://agentprime.io/advisories/GHSA-xhgx-7974-c8v6.md)
  `GHSA-xhgx-7974-c8v6`, `CVE-2023-51084` · Maven `com.github:hyavijava`: affected `<=6.0.07.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Dec 2023 · Tags: Memory corruption
- [json-path Out-of-bounds Write vulnerability](https://agentprime.io/advisories/GHSA-pfh2-hfmq-phg5.md)
  `GHSA-pfh2-hfmq-phg5`, `CVE-2023-51074` · Maven `com.jayway.jsonpath:json-path`: affected `>=2.2.0, <2.9.0`, fixed in `2.9.0` · CVSS 5.3 Medium · Not analysed yet · Published 27 Dec 2023 · Tags: Memory corruption
- [hutool-core was discovered to contain a stack overflow via NumberUtil.toBigDecimal method](https://agentprime.io/advisories/GHSA-m5hf-m3r2-xq53.md)
  `GHSA-m5hf-m3r2-xq53`, `CVE-2023-51080` · Maven `cn.hutool:hutool-core`: affected `>=5.8.22, <5.8.25`, fixed in `5.8.25` · CVSS 7.5 High · Not analysed yet · Published 27 Dec 2023 · Tags: Memory corruption
- [mvel2 TimeOut error exists in the ParseTools.subCompileExpression method](https://agentprime.io/advisories/GHSA-h63j-xqx6-w58r.md)
  `GHSA-h63j-xqx6-w58r`, `CVE-2023-51079` · Maven `org.mvel:mvel2`: affected `=2.5.0.Final`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Dec 2023
- [hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function](https://agentprime.io/advisories/GHSA-7m7h-rgvp-3v4r.md)
  `GHSA-7m7h-rgvp-3v4r`, `CVE-2023-51075` · Maven `cn.hutool:hutool-core`: affected `<5.8.24`, fixed in `5.8.24` · CVSS 7.5 High · Not analysed yet · Published 27 Dec 2023 · Tags: Denial of service
- [OpenCRX Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-8wjx-p2f8-5rjp.md)
  `GHSA-8wjx-p2f8-5rjp`, `CVE-2023-27150` · Maven `org.opencrx:opencrx-core`: affected `<=5.2.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 26 Dec 2023 · Tags: Cross-site scripting (XSS)
- [WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-rfq3-wpjh-ppvg.md)
  `GHSA-rfq3-wpjh-ppvg`, `CVE-2023-6911` · Maven `org.wso2.carbon.registry:carbon-registry`: affected `<4.7.37`, fixed in `4.7.37` · CVSS 4.8 Medium · Not analysed yet · Published 22 Dec 2023 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDIzLTEyLTIyVDE4OjMwOjMwLjAwMDAwMFoiLCJHSFNBLXJmcTMtd3BqaC1wcHZnIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTAxLTI0VDE4OjMxOjAyLjAwMDAwMFoiLCJHSFNBLWY2N2YtMmo2ci1tNGM5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTAxLTI0VDE4OjMxOjAyLjAwMDAwMFoiLCJHSFNBLWY2N2YtMmo2ci1tNGM5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.