# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Session Fixation Apache DolphinScheduler](https://agentprime.io/advisories/GHSA-vjqc-g788-f378.md)
  `GHSA-vjqc-g788-f378`, `CVE-2023-50270` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `>=1.3.8, <3.2.1`, fixed in `3.2.1` · CVSS 6.5 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Authentication bypass
- [Arbitrary File Read Vulnerability in Apache Dolphinscheduler](https://agentprime.io/advisories/GHSA-ff2w-wm48-jhqj.md)
  `GHSA-ff2w-wm48-jhqj`, `CVE-2023-51770` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2024 · Tags: Code injection
- [Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character](https://agentprime.io/advisories/GHSA-548x-j6x6-hcv4.md)
  `GHSA-548x-j6x6-hcv4`, `CVE-2024-25608` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp19 || >=7.3.0, <7.3.10.u4 || >=7.4.0, <7.4.13.u19`, fixed in `7.2.10.fp19`, `7.3.10.u4`, `7.4.13.u19` · CVSS 6.1 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Open redirect
- [Liferay Portal defaults to a low work factor for the default password hashing algorithm](https://agentprime.io/advisories/GHSA-43h9-p3j4-39hm.md)
  `GHSA-43h9-p3j4-39hm`, `CVE-2024-25607` · Maven `com.liferay.portal:com.liferay.portal.kernel` and 2 more: affected `<38.0.0`, fixed in `38.0.0` · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2024 · Tags: Weak cryptography or TLS
- [Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes](https://agentprime.io/advisories/GHSA-3qq5-wcrx-4h8r.md)
  `GHSA-3qq5-wcrx-4h8r`, `CVE-2024-25609` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.2.10.fp15, <=7.2.10.fp18 || >=7.4.0, <7.4.13.u9`, fixed in `7.4.13.u9` · CVSS 6.1 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Open redirect
- [Improper Certificate Validation in Apache DolphinScheduler](https://agentprime.io/advisories/GHSA-37gx-jqx9-fwmg.md)
  `GHSA-37gx-jqx9-fwmg`, `CVE-2023-49250` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 7.3 High · Not analysed yet · Published 20 Feb 2024 · Tags: Weak cryptography or TLS
- [Remote Code Execution in Apache Dolphinscheduler](https://agentprime.io/advisories/GHSA-qwxx-xww6-8q8m.md)
  `GHSA-qwxx-xww6-8q8m`, `CVE-2023-49109` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `>=3.0.0, <3.2.1`, fixed in `3.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2024 · Tags: Code injection
- [Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions](https://agentprime.io/advisories/GHSA-pw7p-3648-qqmg.md)
  `GHSA-pw7p-3648-qqmg`, `CVE-2024-25604` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp17`, fixed in `7.2.10.fp17` · CVSS 6.5 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Broken access control
- [Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API](https://agentprime.io/advisories/GHSA-mf8h-grfg-j9j3.md)
  `GHSA-mf8h-grfg-j9j3`, `CVE-2024-25605` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp17`, fixed in `7.2.10.fp17` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Broken access control
- [Liferay Portal has an XXE vulnerability in Java2WsddTask.\_format](https://agentprime.io/advisories/GHSA-869h-qhfx-w939.md)
  `GHSA-869h-qhfx-w939`, `CVE-2024-25606` · Maven `com.liferay.portal:com.liferay.util.java` and 2 more: affected `<14.0.0`, fixed in `14.0.0` · CVSS 8.0 High · Not analysed yet · Published 20 Feb 2024 · Tags: XML external entities (XXE)
- [Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options](https://agentprime.io/advisories/GHSA-qpgh-6v9w-vfv6.md)
  `GHSA-qpgh-6v9w-vfv6`, `CVE-2024-25149` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp15`, fixed in `7.2.10.fp15` · CVSS 5.4 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Broken access control
- [Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel](https://agentprime.io/advisories/GHSA-4585-28v2-8h46.md)
  `GHSA-4585-28v2-8h46`, `CVE-2024-25150` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp19 || >=7.3.0, <7.3.10.u4`, fixed in `7.2.10.fp19`, `7.3.10.u4` · CVSS 4.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Information disclosure
- [Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated](https://agentprime.io/advisories/GHSA-w3w6-26f2-p474.md)
  `GHSA-w3w6-26f2-p474`, `CVE-2024-22234` · Maven `org.springframework.security:spring-security-core`: affected `>=6.1.0, <6.1.7 || >=6.2.0, <6.2.2`, fixed in `6.1.7`, `6.2.2` · CVSS 7.4 High · Not analysed yet · Published 20 Feb 2024 · Tags: Broken access control
- [Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page](https://agentprime.io/advisories/GHSA-3mrr-cw9q-727m.md)
  `GHSA-3mrr-cw9q-727m`, `CVE-2023-44308` · Maven `com.liferay:com.liferay.adaptive.media.web`: affected `>=2023.Q3, <2023.Q3.6 || >=7.4.0, <=7.4.13.u92`, fixed in `2023.Q3.6` · CVSS 6.1 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Open redirect
- [Privilege escalation in Liferay Portal](https://agentprime.io/advisories/GHSA-mc8m-4r3w-q2hw.md)
  `GHSA-mc8m-4r3w-q2hw`, `CVE-2022-45320` · Maven `com.liferay.portal:release.portal.bom`: affected `<7.4.3.16`, fixed in `7.4.3.16` · CVSS 6.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Broken access control
- [Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page](https://agentprime.io/advisories/GHSA-f3rf-cr7f-cwc4.md)
  `GHSA-f3rf-cr7f-cwc4`, `CVE-2023-5190` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q3, <2023.Q3.6 || >=7.4.13.u45, <=7.4.13.u92`, fixed in `2023.Q3.6` · CVSS 6.1 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Open redirect
- [Undertow Uncontrolled Resource Consumption Vulnerability](https://agentprime.io/advisories/GHSA-w6qf-42m7-vh68.md)
  `GHSA-w6qf-42m7-vh68`, `CVE-2024-1635` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Final, <2.3.12.Final || <2.2.31.Final`, fixed in `2.3.12.Final`, `2.2.31.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2024 · Tags: Denial of service
- [Duplicate Advisory: SQL injection in pgjdbc](https://agentprime.io/advisories/GHSA-xfg6-62px-cxc2.md)
  `GHSA-xfg6-62px-cxc2` · Maven `org.postgresql:postgresql`: affected `>=42.7.0, <42.7.2 || >=42.6.0, <42.6.1 || >=42.5.0, <42.5.5 || >=42.4.0, <42.4.4 || >=42.3.0, <42.3.9 || <42.2.8`, fixed in `42.7.2`, `42.6.1`, `42.5.5`, `42.4.4`, `42.3.9`, `42.2.8` · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 19 Feb 2024 · Tags: SQL injection
- [Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file](https://agentprime.io/advisories/GHSA-4265-ccf5-phj5.md)
  `GHSA-4265-ccf5-phj5`, `CVE-2024-26308` · Maven `org.apache.commons:commons-compress`: affected `>=1.21, <1.26.0`, fixed in `1.26.0` · CVSS 5.5 Medium · Not analysed yet · Published 19 Feb 2024 · Tags: Denial of service
- [Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file](https://agentprime.io/advisories/GHSA-4g9r-vxhx-9pgx.md)
  `GHSA-4g9r-vxhx-9pgx`, `CVE-2024-25710` · Maven `org.apache.commons:commons-compress`: affected `>=1.3, <1.26.0`, fixed in `1.26.0` · CVSS 8.1 High · Not analysed yet · Published 19 Feb 2024 · Tags: Denial of service
- [Vulnerability affecting the org.openjfx:javafx-media maven component of the OpenJFX project](https://agentprime.io/advisories/GHSA-47g3-mf24-6559.md)
  `GHSA-47g3-mf24-6559`, `BIT-java-2024-20925`, `BIT-java-min-2024-20925`, `BIT-jre-2024-20925`, `CVE-2024-20925` · Maven `org.openjfx:javafx-media`: affected `<17.0.10 || >=18, <21.0.2`, fixed in `17.0.10`, `21.0.2` · CVSS 3.1 Low · Not analysed yet · Published 17 Feb 2024
- [Hazelcast Platform permission checking in CSV File Source connector](https://agentprime.io/advisories/GHSA-8h4x-xvjp-vf99.md)
  `GHSA-8h4x-xvjp-vf99`, `CVE-2023-45860` · Maven `com.hazelcast:hazelcast` and 1 more: affected `>=5.3.0, <5.3.5 || >=5.2.0, <5.2.5 || <=5.1.7`, fixed in `5.3.5`, `5.2.5` · CVSS 6.5 Medium · Not analysed yet · Published 16 Feb 2024 · Tags: SQL injection
- [Absolute path traversal vulnerability in digdag server](https://agentprime.io/advisories/GHSA-5mp4-32rr-v3x5.md)
  `GHSA-5mp4-32rr-v3x5`, `CVE-2024-25125` · Maven `io.digdag:digdag-server`: affected `<0.10.5.1`, fixed in `0.10.5.1` · CVSS 5.3 Medium · EPSS 0.30 · Not analysed yet · Published 14 Feb 2024 · Tags: Path traversal
- [Undertow Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-v76w-3ph8-vm66.md)
  `GHSA-v76w-3ph8-vm66`, `CVE-2024-1459` · Maven `io.undertow:undertow-core`: affected `<2.2.31.Final || >=2.3.0.Alpha1, <2.3.12.Final`, fixed in `2.2.31.Final`, `2.3.12.Final` · CVSS 5.3 Medium · Not analysed yet · Published 12 Feb 2024 · Tags: Path traversal
- [OpenRefine JDBC Attack Vulnerability](https://agentprime.io/advisories/GHSA-6p92-qfqf-qwx4.md)
  `GHSA-6p92-qfqf-qwx4`, `CVE-2024-23833` · Maven `org.openrefine:database`: affected `<3.7.8`, fixed in `3.7.8` · CVSS 7.5 High · Not analysed yet · Published 12 Feb 2024 · Tags: Path traversal, Broken access control
- [Denial of Service in Connect2id Nimbus JOSE+JWT](https://agentprime.io/advisories/GHSA-gvpg-vgmx-xg6w.md)
  `GHSA-gvpg-vgmx-xg6w`, `CVE-2023-52428` · Maven `com.nimbusds:nimbus-jose-jwt`: affected `<9.37.2`, fixed in `9.37.2` · CVSS 7.5 High · Not analysed yet · Published 11 Feb 2024 · Tags: Denial of service
- [angular vulnerable to super-linear runtime due to backtracking](https://agentprime.io/advisories/GHSA-4w4v-5hc9-xrr2.md)
  `GHSA-4w4v-5hc9-xrr2`, `CVE-2024-21490` · Maven `org.webjars.bower:angular` and 2 more: affected `>=1.3.0, <=1.8.3`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2024 · Tags: Denial of service
- [Apache Solr's Streaming Expressions allow users to extract data from other Solr Clouds](https://agentprime.io/advisories/GHSA-xrj7-x7gp-wwqr.md)
  `GHSA-xrj7-x7gp-wwqr`, `BIT-solr-2023-50298`, `CVE-2023-50298` · Maven `org.apache.solr:solr-solrj` and 1 more: affected `>=9.0.0, <9.4.1 || >=6.0.0, <8.11.3`, fixed in `9.4.1`, `8.11.3` · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2024 · Tags: Information disclosure
- [Apache Solr Schema Designer blindly "trusts" all configsets](https://agentprime.io/advisories/GHSA-4wxw-42wx-2wfx.md)
  `GHSA-4wxw-42wx-2wfx`, `BIT-solr-2023-50292`, `CVE-2023-50292` · Maven `org.apache.solr:solr-core`: affected `>=9.0.0, <9.3.0 || >=8.10.0, <8.11.3`, fixed in `9.3.0`, `8.11.3` · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2024 · Tags: Broken access control
- [Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies](https://agentprime.io/advisories/GHSA-3hwc-rqwp-v36q.md)
  `GHSA-3hwc-rqwp-v36q`, `BIT-solr-2023-50291`, `CVE-2023-50291` · Maven `org.apache.solr:solr-core`: affected `>=6.0.0, <8.11.3 || >=9.0.0, <9.3.0`, fixed in `8.11.3`, `9.3.0` · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2024 · Tags: Hard-coded credentials
- [Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets](https://agentprime.io/advisories/GHSA-37vr-vmg4-jwpw.md)
  `GHSA-37vr-vmg4-jwpw`, `BIT-solr-2023-50386`, `CVE-2023-50386` · Maven `org.apache.solr:solr-core`: affected `>=6.0.0, <8.11.3 || >=9.0.0, <9.4.1`, fixed in `8.11.3`, `9.4.1` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.84 · Not analysed yet · Published 9 Feb 2024 · Tags: Unrestricted file upload, CWE-913
- [Micronaut management endpoints vulnerable to drive-by localhost attack](https://agentprime.io/advisories/GHSA-583g-g682-crxf.md)
  `GHSA-583g-g682-crxf`, `CVE-2024-23639` · Maven `io.micronaut:micronaut-http-server` and 2 more: affected `<3.8.3`, fixed in `3.8.3` · CVSS 5.1 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-15, CWE-610, CWE-664
- [XXL-JOB vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-c352-x843-ggpq.md)
  `GHSA-c352-x843-ggpq`, `CVE-2024-24113` · Maven `com.xuxueli:xxl-job`: affected `<=2.4.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 8 Feb 2024 · Tags: Server-side request forgery (SSRF)
- [Liferay Portal denial-of-service vulnerability](https://agentprime.io/advisories/GHSA-w275-m8cr-hf2v.md)
  `GHSA-w275-m8cr-hf2v`, `CVE-2024-25144` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.2.0, <7.2.10.fp19 || >=7.3.0, <7.3.10.u6 || >=7.4.0, <7.4.13.u27`, fixed in `7.2.10.fp19`, `7.3.10.u6`, `7.4.13.u27` · CVSS 4.1 Medium · Not analysed yet · Published 8 Feb 2024 · Tags: Denial of service
- [Liferay Portal vulnerable to user impersonation](https://agentprime.io/advisories/GHSA-qwj8-qgpr-8crm.md)
  `GHSA-qwj8-qgpr-8crm`, `CVE-2024-25148` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.2.0, <7.2.10.fp15 || >=7.3.0, <7.3.10.u4`, fixed in `7.2.10.fp15`, `7.3.10.u4` · CVSS 5.4 Medium · Not analysed yet · Published 8 Feb 2024 · Tags: Information disclosure
- [Liferay Portal allows attackers to discover the existence of sites](https://agentprime.io/advisories/GHSA-mqf8-4cqm-p83x.md)
  `GHSA-mqf8-4cqm-p83x`, `CVE-2024-25146` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp18`, fixed in `7.3.10.u4`, `7.2.10.fp18` · CVSS 5.3 Medium · Not analysed yet · Published 8 Feb 2024 · Tags: Information disclosure, CWE-204
- [Liferay Portal's account lockout does not invalidate existing user sessions](https://agentprime.io/advisories/GHSA-2mx7-xvfg-fg53.md)
  `GHSA-2mx7-xvfg-fg53`, `CVE-2023-47798` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.2.0, <7.2.10.fp5`, fixed in `7.2.10.fp5` · CVSS 5.4 Medium · Not analysed yet · Published 8 Feb 2024 · Tags: Authentication bypass
- [Graylog session fixation vulnerability through cookie injection](https://agentprime.io/advisories/GHSA-3xf8-g8gr-g7rh.md)
  `GHSA-3xf8-g8gr-g7rh`, `CVE-2024-24823` · Maven `org.graylog2:graylog2-server`: affected `>=4.3.0, <5.1.11 || >=5.2.0-alpha.1, <5.2.4`, fixed in `5.1.11`, `5.2.4` · CVSS 5.7 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Authentication bypass
- [Graylog vulnerable to instantiation of arbitrary classes triggered by API request](https://agentprime.io/advisories/GHSA-p6gg-5hf4-4rgj.md)
  `GHSA-p6gg-5hf4-4rgj`, `CVE-2024-24824` · Maven `org.graylog2:graylog2-server`: affected `>=2.0.0, <5.1.11 || >=5.2.0-alpha.1, <5.2.4`, fixed in `5.1.11`, `5.2.4` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 7 Feb 2024 · Tags: Broken access control
- [Liferay Portal stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-9vgq-w5pv-v77q.md)
  `GHSA-9vgq-w5pv-v77q`, `CVE-2024-25145` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.4.0, <7.4.3.13u8 || >=7.3.0, <7.3.10.u4 || <7.2.10.fp17`, fixed in `7.4.3.13u8`, `7.3.10.u4`, `7.2.10.fp17` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal denial of service (memory consumption)](https://agentprime.io/advisories/GHSA-87m3-6qj3-p3xh.md)
  `GHSA-87m3-6qj3-p3xh`, `CVE-2024-25143` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.2.0, <7.3.7`, fixed in `7.3.7` · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Denial of service
- [Apache Ozone Improper Authentication vulnerability](https://agentprime.io/advisories/GHSA-6726-2rx3-cgwh.md)
  `GHSA-6726-2rx3-cgwh`, `CVE-2023-39196` · Maven `org.apache.ozone:ozone-main`: affected `>=1.2.0, <1.4.0`, fixed in `1.4.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Authentication bypass
- [Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability](https://agentprime.io/advisories/GHSA-c57v-4vg5-cm2x.md)
  `GHSA-c57v-4vg5-cm2x`, `CVE-2023-51437` · Maven `org.apache.pulsar:pulsar-broker-auth-sasl`: affected `<2.11.3 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.1`, fixed in `2.11.3`, `3.0.2`, `3.1.1` · CVSS 7.4 High · Not analysed yet · Published 7 Feb 2024 · Tags: Information disclosure
- [Apache Sling Servlets Resolver executes malicious code via path traversal](https://agentprime.io/advisories/GHSA-h2rq-qhr7-53gm.md)
  `GHSA-h2rq-qhr7-53gm`, `CVE-2024-23673` · Maven `org.apache.sling:org.apache.sling.servlets.resolver`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 8.5 High · Not analysed yet · Published 6 Feb 2024 · Tags: Path traversal
- [Spring Security's spring-security.xsd file is world writable](https://agentprime.io/advisories/GHSA-9gp8-6cg8-7h34.md)
  `GHSA-9gp8-6cg8-7h34`, `CVE-2023-34042` · Maven `org.springframework.security:spring-security-config`: affected `>=6.1.1, <6.1.4 || >=6.0.4, <6.0.7 || >=5.8.4, <5.8.7 || >=5.7.9, <5.7.11`, fixed in `6.1.4`, `6.0.7`, `5.8.7`, `5.7.11` · CVSS 4.1 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: Broken access control
- [mingSoft MCMS File Upload vulnerability](https://agentprime.io/advisories/GHSA-7qw4-9r68-2rmx.md)
  `GHSA-7qw4-9r68-2rmx`, `CVE-2024-22567` · Maven `net.mingsoft:ms-mcms`: affected `<=5.3.5`, no fixed version yet · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 5 Feb 2024 · Tags: Unrestricted file upload
- [Malicious input can provoke XSS when preserving comments](https://agentprime.io/advisories/GHSA-2mrq-w8pv-5pvq.md)
  `GHSA-2mrq-w8pv-5pvq`, `CVE-2024-23635` · Maven `org.owasp.antisamy:antisamy`: affected `<1.7.5`, fixed in `1.7.5` · CVSS 6.1 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Central Dogma Authentication Bypass Vulnerability via Session Leakage](https://agentprime.io/advisories/GHSA-34q3-p352-c7q8.md)
  `GHSA-34q3-p352-c7q8`, `CVE-2024-1143` · Maven `com.linecorp.centraldogma:centraldogma-server`: affected `<0.64.1`, fixed in `0.64.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage](https://agentprime.io/advisories/GHSA-qfv2-3p2f-vg48.md)
  `GHSA-qfv2-3p2f-vg48` · Maven `com.linecorp.centraldogma:centraldogma-server`: affected `<0.64.0`, fixed in `0.64.0` · No CVSS score · Withdrawn · Not analysed yet · Published 2 Feb 2024
- [Beetl Server-Side Template Injection vulnerability](https://agentprime.io/advisories/GHSA-9gh8-877r-g477.md)
  `GHSA-9gh8-877r-g477`, `CVE-2024-22533` · Maven `com.ibeetl:beetl-core`: affected `<3.15.13.RELEASE`, fixed in `3.15.13.RELEASE` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2024 · Tags: Code injection
- [Spring Cloud Contract vulnerable to local information disclosure](https://agentprime.io/advisories/GHSA-p6rp-mx85-m459.md)
  `GHSA-p6rp-mx85-m459`, `CVE-2024-22236` · Maven `org.springframework.cloud:spring-cloud-contract-shade`: affected `>=4.1.0, <4.1.1 || >=4.0.0, <4.0.5 || >=3.1.0, <3.1.10`, fixed in `4.1.1`, `4.0.5`, `3.1.10` · CVSS 3.3 Low · Not analysed yet · Published 31 Jan 2024 · Tags: Broken access control, CWE-377
- [CrateDB database has an arbitrary file read vulnerability](https://agentprime.io/advisories/GHSA-475g-vj6c-xf96.md)
  `GHSA-475g-vj6c-xf96`, `CVE-2024-24565` · Maven `io.crate:crate`: affected `<5.3.9 || >=5.4.0, <5.4.8 || >=5.5.0, <5.5.4 || >=5.6.0, <5.6.1`, fixed in `5.3.9`, `5.4.8`, `5.5.4`, `5.6.1` · CVSS 5.7 Medium · Not analysed yet · Published 30 Jan 2024 · Tags: Path traversal
- [CrateDB authentication bypass vulnerability](https://agentprime.io/advisories/GHSA-7mgx-gvjw-m3w3.md)
  `GHSA-7mgx-gvjw-m3w3`, `CVE-2023-51982` · Maven `io.crate:crate`: affected `<5.2.11 || >=5.3.0, <5.3.8 || >=5.4.0, <5.4.7 || >=5.5.0, <5.5.2`, fixed in `5.2.11`, `5.3.8`, `5.4.7`, `5.5.2` · CVSS 7.5 High · Not analysed yet · Published 30 Jan 2024 · Tags: Authentication bypass
- [Apache Kylin has Insufficiently Protected Credentials](https://agentprime.io/advisories/GHSA-3vvc-v8c2-43r7.md)
  `GHSA-3vvc-v8c2-43r7`, `CVE-2023-29055` · Maven `org.apache.kylin:kylin-core-common`: affected `>=2.0.0, <4.0.4`, fixed in `4.0.4` · CVSS 7.5 High · Not analysed yet · Published 29 Jan 2024 · Tags: Hard-coded credentials
- [Quarkus Improper Handling of Insufficient Permissions or Privileges and Improper Handling of Exceptional Conditions vulnerability](https://agentprime.io/advisories/GHSA-8j3x-w35r-rw4r.md)
  `GHSA-8j3x-w35r-rw4r`, `CVE-2023-6267` · Maven `io.quarkus.resteasy.reactive:resteasy-reactive`: affected `<2.13.9.Final || >=3.0.0.Final, <3.2.9.Final`, fixed in `2.13.9.Final`, `3.2.9.Final` · CVSS 8.6 High · Not analysed yet · Published 25 Jan 2024 · Tags: Insecure deserialization, CWE-280, CWE-755
- [Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin](https://agentprime.io/advisories/GHSA-x22x-5pp9-8v7f.md)
  `GHSA-x22x-5pp9-8v7f`, `CVE-2024-23905` · Maven `io.jenkins.plugins:redhat-dependency-analytics`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 8.0 High · Not analysed yet · Published 24 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Arbitrary file read vulnerability in Git server Plugin can lead to RCE](https://agentprime.io/advisories/GHSA-vph5-2q33-7r9h.md)
  `GHSA-vph5-2q33-7r9h`, `CVE-2024-23899` · Maven `org.jenkins-ci.plugins:git-server`: affected `<99.101.v720e86326c09`, fixed in `99.101.v720e86326c09` · CVSS 8.8 High · Not analysed yet · Published 24 Jan 2024 · Tags: Path traversal
- [Arbitrary file read vulnerability in Jenkins Log Command Plugin](https://agentprime.io/advisories/GHSA-qjpf-2jhx-3758.md)
  `GHSA-qjpf-2jhx-3758`, `CVE-2024-23904` · Maven `org.jenkins-ci.plugins:log-command`: affected `<=1.0.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 Jan 2024 · Tags: Path traversal
- [Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin](https://agentprime.io/advisories/GHSA-fw9h-cxx9-gfq3.md)
  `GHSA-fw9h-cxx9-gfq3`, `CVE-2024-23901` · Maven `io.jenkins.plugins:gitlab-branch-source`: affected `<688.v5fa`, fixed in `688.v5fa` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jan 2024 · Tags: Information disclosure
- [Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin](https://agentprime.io/advisories/GHSA-f67f-2j6r-m4c9.md)
  `GHSA-f67f-2j6r-m4c9`, `CVE-2024-23903` · Maven `io.jenkins.plugins:gitlab-branch-source`: affected `<688.v5fa`, fixed in `688.v5fa` · CVSS 3.7 Low · Not analysed yet · Published 24 Jan 2024 · Tags: CWE-697

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTAxLTI0VDE4OjMxOjAyLjAwMDAwMFoiLCJHSFNBLWY2N2YtMmo2ci1tNGM5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTAyLTIwVDE1OjMxOjAzLjAwMDAwMFoiLCJHSFNBLTI5eHgtZmhmZi0zNm03Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTAyLTIwVDE1OjMxOjAzLjAwMDAwMFoiLCJHSFNBLTI5eHgtZmhmZi0zNm03Il0>. Everything for agents: <https://agentprime.io/llms.txt>.