# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Jenkins Delphix Plugin has improper SSL/TLS certificate validation](https://agentprime.io/advisories/GHSA-pfh3-j79r-vqrj.md)
  `GHSA-pfh3-j79r-vqrj`, `CVE-2024-28162` · Maven `org.jenkins-ci.plugins:delphix`: affected `>=3.0.1, <3.1.1`, fixed in `3.1.1` · CVSS 4.2 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Weak cryptography or TLS
- [Jenkins Subversion Partial Release Manager Plugin missing permission check](https://agentprime.io/advisories/GHSA-mr9j-qqjh-67f2.md)
  `GHSA-mr9j-qqjh-67f2`, `CVE-2024-28159` · Maven `org.jenkins-ci.plugins:svn-partial-release-mgr`: affected `<=1.0.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Broken access control
- [Jenkins docker-build-step Plugin missing permission check](https://agentprime.io/advisories/GHSA-8h2m-54wh-gwj3.md)
  `GHSA-8h2m-54wh-gwj3`, `CVE-2024-2216` · Maven `org.jenkins-ci.plugins:docker-build-step`: affected `<=2.11`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Broken access control
- [Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-64c5-r2h5-c2fg.md)
  `GHSA-64c5-r2h5-c2fg`, `CVE-2024-2215` · Maven `org.jenkins-ci.plugins:docker-build-step`: affected `<=2.11`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site request forgery (CSRF)
- [Jenkins iceScrum Plugin vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-2pc2-h97h-2mmw.md)
  `GHSA-2pc2-h97h-2mmw`, `CVE-2024-28160` · Maven `org.jenkins-ci.plugins:icescrum`: affected `<=1.1.6`, no fixed version yet · CVSS 8.0 High · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Jenkins AppSpider Plugin missing permission checks](https://agentprime.io/advisories/GHSA-xxv9-w5hm-328j.md)
  `GHSA-xxv9-w5hm-328j`, `CVE-2024-28155` · Maven `com.rapid7:jenkinsci-appspider-plugin`: affected `<1.0.17`, fixed in `1.0.17` · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Broken access control
- [Jenkins HTML Publisher Plugin Stored XSS vulnerability](https://agentprime.io/advisories/GHSA-xrrw-9j78-hpf3.md)
  `GHSA-xrrw-9j78-hpf3`, `CVE-2024-28150` · Maven `org.jenkins-ci.plugins:htmlpublisher`: affected `<1.32.1`, fixed in `1.32.1` · CVSS 8.0 High · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Jenkins Subversion Partial Release Manager Plugin vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-rv35-69ff-g9gv.md)
  `GHSA-rv35-69ff-g9gv`, `CVE-2024-28158` · Maven `org.jenkins-ci.plugins:svn-partial-release-mgr`: affected `<=1.0.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests](https://agentprime.io/advisories/GHSA-m4rm-x2rr-357w.md)
  `GHSA-m4rm-x2rr-357w`, `CVE-2024-28152` · Maven `org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source`: affected `<871.v28d74e8b_4226`, fixed in `871.v28d74e8b_4226` · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-281
- [Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability](https://agentprime.io/advisories/GHSA-9pp4-mx6x-xh36.md)
  `GHSA-9pp4-mx6x-xh36`, `CVE-2024-28153` · Maven `org.jenkins-ci.plugins:dependency-check-jenkins-plugin`: affected `<5.4.6`, fixed in `5.4.6` · CVSS 5.4 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Jenkins HTML Publisher Plugin does not properly sanitize input](https://agentprime.io/advisories/GHSA-8vcg-v7g4-3vr7.md)
  `GHSA-8vcg-v7g4-3vr7`, `CVE-2024-28149` · Maven `org.jenkins-ci.plugins:htmlpublisher`: affected `>=1.16, <1.32.1`, fixed in `1.32.1` · CVSS 8.0 High · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Jenkins MQ Notifier Plugin exposes sensitive information in build logs](https://agentprime.io/advisories/GHSA-8fm4-r23p-v68v.md)
  `GHSA-8fm4-r23p-v68v`, `CVE-2024-28154` · Maven `com.sonymobile.jenkins.plugins.mq:mq-notifier`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 6.5 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Information disclosure
- [Jenkins GitBucket Plugin vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-5j74-g3c5-wqww.md)
  `GHSA-5j74-g3c5-wqww`, `CVE-2024-28157` · Maven `org.jenkins-ci.plugins:gitbucket`: affected `<=0.8`, no fixed version yet · CVSS 8.0 High · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Jenkins Build Monitor View Plugin vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-5j5r-6mv9-m255.md)
  `GHSA-5j5r-6mv9-m255`, `CVE-2024-28156` · Maven `org.jenkins-ci.plugins:build-monitor-plugin`: affected `<=1.14-860.vd06ef2568b`, no fixed version yet · CVSS 5.4 Medium · EPSS 0.79 · Not analysed yet · Published 6 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Jenkins HTML Publisher Plugin Path traversal vulnerability](https://agentprime.io/advisories/GHSA-478x-m3mx-7j3f.md)
  `GHSA-478x-m3mx-7j3f`, `CVE-2024-28151` · Maven `org.jenkins-ci.plugins:htmlpublisher`: affected `<1.32.1`, fixed in `1.32.1` · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Path traversal
- [Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged](https://agentprime.io/advisories/GHSA-m757-p8rv-4q93.md)
  `GHSA-m757-p8rv-4q93`, `CVE-2023-50740` · Maven `org.apache.linkis:linkis`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: Information disclosure
- [Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability](https://agentprime.io/advisories/GHSA-p2gx-4434-pf6g.md)
  `GHSA-p2gx-4434-pf6g`, `CVE-2024-26580` · Maven `org.apache.inlong:manager-common`: affected `>=1.8.0, <1.11.0`, fixed in `1.11.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2024 · Tags: Insecure deserialization
- [Apache Archiva Incorrect Authorization vulnerability](https://agentprime.io/advisories/GHSA-rv4h-m4wc-v99w.md)
  `GHSA-rv4h-m4wc-v99w`, `CVE-2024-27138` · Maven `org.apache.archiva:archiva`: affected `<=2.2.10`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 1 Mar 2024 · Tags: Broken access control
- [Apache Archiva Reflected Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-hp2x-6vrm-7j7v.md)
  `GHSA-hp2x-6vrm-7j7v`, `CVE-2024-27140` · Maven `org.apache.archiva:archiva-common`: affected `>=2.0.0, <=2.2.10`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 1 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Apache Archiva Incorrect Authorization vulnerability](https://agentprime.io/advisories/GHSA-h595-vwhc-3xwx.md)
  `GHSA-h595-vwhc-3xwx`, `CVE-2024-27139` · Maven `org.apache.archiva:archiva`: affected `>=2.0.0, <=2.2.10`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 1 Mar 2024 · Tags: Broken access control
- [Apache Ambari: Various Cross site scripting problems](https://agentprime.io/advisories/GHSA-9q6v-rxmw-g3gh.md)
  `GHSA-9q6v-rxmw-g3gh`, `CVE-2023-50378` · Maven `org.apache.ambari:ambari`: affected `<2.7.8`, fixed in `2.7.8` · CVSS 6.1 Medium · Not analysed yet · Published 1 Mar 2024 · Tags: Cross-site scripting (XSS), CWE-20
- [Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service](https://agentprime.io/advisories/GHSA-vr64-r9qj-h27f.md)
  `GHSA-vr64-r9qj-h27f`, `CVE-2024-22871` · Maven `org.clojure:clojure`: affected `>=1.7.0, <1.11.2 || >=1.12.0-alpha1, <1.12.0-alpha9`, fixed in `1.11.2`, `1.12.0-alpha9` · CVSS 7.5 High · Not analysed yet · Published 29 Feb 2024 · Tags: Insecure deserialization
- [Duplicate Advisory: Keycloak DoS via account lockout](https://agentprime.io/advisories/GHSA-3hrr-xwvg-hxvr.md)
  `GHSA-3hrr-xwvg-hxvr` · Maven `org.keycloak:keycloak-core`: affected `<24.0.0`, fixed in `24.0.0` · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 29 Feb 2024 · Tags: CWE-645
- [jose4j denial of service via specifically crafted JWE](https://agentprime.io/advisories/GHSA-6qvw-249j-h44c.md)
  `GHSA-6qvw-249j-h44c`, `CVE-2023-51775` · Maven `org.bitbucket.b_c:jose4j`: affected `<0.9.4`, fixed in `0.9.4` · CVSS 6.5 Medium · Not analysed yet · Published 29 Feb 2024 · Tags: Denial of service
- [Missing permission checks on Hazelcast client protocol](https://agentprime.io/advisories/GHSA-xh6m-7cr7-xx66.md)
  `GHSA-xh6m-7cr7-xx66`, `CVE-2023-45859` · Maven `com.hazelcast:hazelcast` and 1 more: affected `<=4.1.10 || >=4.2, <=4.2.8 || >=5.0, <=5.0.5 || >=5.1, <=5.1.7 || >=5.2.0, <5.2.5 || >=5.3.0, <5.3.5`, fixed in `5.2.5`, `5.3.5` · CVSS 7.6 High · Not analysed yet · Published 27 Feb 2024 · Tags: Information disclosure, CWE-281
- [Apache Ambari XML External Entity injection](https://agentprime.io/advisories/GHSA-qrp9-23p7-g5mf.md)
  `GHSA-qrp9-23p7-g5mf`, `CVE-2023-50380` · Maven `org.apache.ambari.contrib.views:wfmanager`: affected `>=2.7.0, <2.7.8`, fixed in `2.7.8` · CVSS 6.5 Medium · Not analysed yet · Published 27 Feb 2024 · Tags: XML external entities (XXE)
- [Apache James MIME4J improper input validation vulnerability](https://agentprime.io/advisories/GHSA-jw7r-rxff-gv24.md)
  `GHSA-jw7r-rxff-gv24`, `CVE-2024-21742` · Maven `org.apache.james:apache-mime4j-core`: affected `<0.8.10`, fixed in `0.8.10` · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2024 · Tags: Other injection, CWE-20
- [SMTP smuggling in Apache James](https://agentprime.io/advisories/GHSA-p5q9-86w4-2xr5.md)
  `GHSA-p5q9-86w4-2xr5`, `CVE-2023-51747` · Maven `org.apache.james:james-server`: affected `<3.7.5 || >=3.8.0, <3.8.1`, fixed in `3.7.5`, `3.8.1` · CVSS 7.1 High · Not analysed yet · Published 27 Feb 2024 · Tags: Authentication bypass, HTTP request smuggling, CWE-20
- [Apache Ambari: authenticated users could perform command injection to perform RCE](https://agentprime.io/advisories/GHSA-rghc-9fhx-h32m.md)
  `GHSA-rghc-9fhx-h32m`, `CVE-2023-50379` · Maven `org.apache.ambari.contrib.views:ambari-contrib-views`: affected `>=2.7.0, <2.7.8`, fixed in `2.7.8` · CVSS 8.8 High · Not analysed yet · Published 27 Feb 2024 · Tags: Code injection
- [Apache James server: Privilege escalation via JMX pre-authentication deserialization](https://agentprime.io/advisories/GHSA-px7w-c9gw-7gj3.md)
  `GHSA-px7w-c9gw-7gj3`, `CVE-2023-51518` · Maven `org.apache.james:james-server`: affected `<3.7.5 || >=3.8.0, <3.8.1`, fixed in `3.7.5`, `3.8.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Feb 2024 · Tags: Insecure deserialization
- [Connection leaking on idle timeout when TCP congested](https://agentprime.io/advisories/GHSA-rggv-cv7r-mw98.md)
  `GHSA-rggv-cv7r-mw98`, `CVE-2024-22201` · Maven `org.eclipse.jetty.http2:http2-common` and 3 more: affected `>=9.3.0, <9.4.54 || >=10.0.0, <10.0.20 || >=11.0.0, <11.0.20`, fixed in `9.4.54`, `10.0.20`, `11.0.20` · CVSS 7.5 High · Not analysed yet · Published 26 Feb 2024 · Tags: Denial of service
- [SAML authentication bypass due to missing validation on unsigned SAML messages](https://agentprime.io/advisories/GHSA-hx5q-v6pj-533r.md)
  `GHSA-hx5q-v6pj-533r` · Maven `com.linecorp.centraldogma:centraldogma-server-auth-saml`: affected `<0.64.3`, fixed in `0.64.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2024 · Tags: CWE-1395
- [Armeria SAML authentication bypass due to missing validation on unsigned SAML messages](https://agentprime.io/advisories/GHSA-4m6j-23p2-8c54.md)
  `GHSA-4m6j-23p2-8c54`, `CVE-2024-1735` · Maven `com.linecorp.armeria:armeria-saml`: affected `<1.27.2`, fixed in `1.27.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2024 · Tags: Authentication bypass
- [Apache Camel data exposure vulnerability](https://agentprime.io/advisories/GHSA-qpxm-689r-3849.md)
  `GHSA-qpxm-689r-3849`, `CVE-2024-22371` · Maven `org.apache.camel:camel-core`: affected `>=3.0.0, <3.21.4 || >=3.22.0, <3.22.1 || >=4.0.0, <4.0.4 || >=4.1.0, <4.4.0`, fixed in `3.21.4`, `3.22.1`, `4.0.4`, `4.4.0` · CVSS 2.9 Low · Not analysed yet · Published 26 Feb 2024 · Tags: Information disclosure
- [Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users](https://agentprime.io/advisories/GHSA-rc6h-qwj9-2c53.md)
  `GHSA-rc6h-qwj9-2c53`, `CVE-2024-23320` · Maven `org.apache.dolphinscheduler:dolphinscheduler-master`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 8.8 High · Not analysed yet · Published 23 Feb 2024 · Tags: CWE-20
- [Spring Web vulnerable to Open Redirect or Server Side Request Forgery](https://agentprime.io/advisories/GHSA-ccgv-vj62-xf9h.md)
  `GHSA-ccgv-vj62-xf9h`, `CVE-2024-22243` · Maven `org.springframework:spring-web`: affected `>=6.1.0, <6.1.4 || >=6.0.0, <6.0.17 || >=5.3.0, <5.3.32 || <=5.2.25.RELEASE`, fixed in `6.1.4`, `6.0.17`, `5.3.32` · CVSS 8.1 High · Not analysed yet · Published 23 Feb 2024 · Tags: Open redirect
- [org.postgresql:postgresql vulnerable to SQL Injection via line comment generation](https://agentprime.io/advisories/GHSA-24rp-q3w6-vc56.md)
  `GHSA-24rp-q3w6-vc56`, `BIT-postgresql-jdbc-driver-2024-1597`, `CVE-2024-1597` · Maven `org.postgresql:postgresql`: affected `<42.2.28 || >=42.3.0, <42.3.9 || >=42.4.0, <42.4.4 || >=42.5.0, <42.5.5 || >=42.6.0, <42.6.1 || >=42.7.0, <42.7.2`, fixed in `42.2.28`, `42.3.9`, `42.4.4`, `42.5.5`, `42.6.1`, `42.7.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: SQL injection
- [XWiki extension license information is public, exposing instance id and license holder details](https://agentprime.io/advisories/GHSA-4hfp-m9gv-m753.md)
  `GHSA-4hfp-m9gv-m753`, `CVE-2024-26138` · Maven `com.xwiki.licensing:application-licensing-licensor-ui`: affected `>=1.0, <1.24.2`, fixed in `1.24.2` · CVSS 5.3 Medium · Not analysed yet · Published 21 Feb 2024 · Tags: Broken access control
- [Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-q2cv-7j58-rfmj.md)
  `GHSA-q2cv-7j58-rfmj`, `CVE-2023-47795` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q3, <2023.Q3.6 || >=7.4.13.u18, <=7.4.13.u92`, fixed in `2023.Q3.6` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing](https://agentprime.io/advisories/GHSA-hgr6-6hhw-883f.md)
  `GHSA-hgr6-6hhw-883f`, `CVE-2024-25151` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp15`, fixed in `7.3.10.u4`, `7.2.10.fp15` · CVSS 5.4 Medium · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-rwxc-4cmw-7x75.md)
  `GHSA-rwxc-4cmw-7x75`, `CVE-2024-26266` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.4.13.u1, <7.4.13.u10 || >=7.3.10.ep3, <7.3.10.u4 || >=7.2.0, <7.2.10.fp17`, fixed in `7.4.13.u10`, `7.3.10.u4`, `7.2.10.fp17` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-rwhv-hvj2-qrqm.md)
  `GHSA-rwhv-hvj2-qrqm`, `CVE-2024-26269` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.4.13.u1, <7.4.13.u38 || >=7.3.10.ep3, <7.3.10.u11 || >=7.2.0, <7.2.10.fp20`, fixed in `7.4.13.u38`, `7.3.10.u11`, `7.2.10.fp20` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-44jg-jgjx-3xg5.md)
  `GHSA-44jg-jgjx-3xg5`, `CVE-2024-25603` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.4.13.u1, <=7.4.13.u102 || >=7.3.10.ep3, <7.3.10.u4 || >=7.2.0, <7.2.10.fp17`, fixed in `7.3.10.u4`, `7.2.10.fp17` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-xpjg-7hx7-wgcx.md)
  `GHSA-xpjg-7hx7-wgcx`, `CVE-2024-25147` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp15`, fixed in `7.3.10.u4`, `7.2.10.fp15` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-v2xq-m22w-jmpr.md)
  `GHSA-v2xq-m22w-jmpr`, `CVE-2024-25602` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp17`, fixed in `7.3.10.u4`, `7.2.10.fp17` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-p28x-4r5h-ph6j.md)
  `GHSA-p28x-4r5h-ph6j`, `CVE-2024-25152` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp17`, fixed in `7.3.10.u4`, `7.2.10.fp17` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-cr36-3vqf-x5w5.md)
  `GHSA-cr36-3vqf-x5w5`, `CVE-2024-25601` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp17`, fixed in `7.3.10.u4`, `7.2.10.fp17` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting](https://agentprime.io/advisories/GHSA-73x3-8mrg-5r93.md)
  `GHSA-73x3-8mrg-5r93`, `CVE-2023-42498` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q3, <2023.Q3.5 || >=7.4.13.u4, <=7.4.13.u92`, fixed in `2023.Q3.5` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting](https://agentprime.io/advisories/GHSA-54pv-r62j-9qqc.md)
  `GHSA-54pv-r62j-9qqc`, `CVE-2023-42496` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.4.10.ep1, <=7.4.13.u92 || >=7.3.10.ep3, <7.3.10.u34 || >=2023.Q3, <2023.Q3.6`, fixed in `7.3.10.u34`, `2023.Q3.6` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting](https://agentprime.io/advisories/GHSA-468x-frcm-ghx6.md)
  `GHSA-468x-frcm-ghx6`, `CVE-2023-40191` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q3, <2023.Q3.6 || >=7.4.13.u44, <=7.4.13.u92`, fixed in `2023.Q3.6` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers](https://agentprime.io/advisories/GHSA-mwhf-6mjm-6w3h.md)
  `GHSA-mwhf-6mjm-6w3h`, `CVE-2021-29038` · Maven `com.liferay:com.liferay.login.web` and 4 more: affected `<5.0.18`, fixed in `5.0.18` · CVSS 6.3 Medium · Not analysed yet · Published 21 Feb 2024 · Tags: CWE-640
- [Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page](https://agentprime.io/advisories/GHSA-mh9r-9pcx-rx55.md)
  `GHSA-mh9r-9pcx-rx55`, `CVE-2021-29050` · Maven `com.liferay.portal:com.liferay.portal.impl` and 1 more: affected `<5.25.0`, fixed in `5.25.0` · CVSS 8.8 High · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site request forgery (CSRF)
- [Cross-site Scripting Vulnerability in Statement Browser](https://agentprime.io/advisories/GHSA-7rw2-3hhp-rc46.md)
  `GHSA-7rw2-3hhp-rc46`, `CVE-2024-26140` · Maven `com.yetanalytics:lrs`: affected `<1.2.17`, fixed in `1.2.17` · CVSS 4.6 Medium · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Deserialization of Untrusted Data in Apache Camel CassandraQL](https://agentprime.io/advisories/GHSA-m43p-55rf-8c2j.md)
  `GHSA-m43p-55rf-8c2j`, `CVE-2024-23114` · Maven `org.apache.camel:camel-cassandraql`: affected `>=3.0.0, <3.21.4 || >=3.22.0, <3.22.1 || >=4.0.0, <4.0.4 || >=4.1.0, <4.4.0`, fixed in `3.21.4`, `3.22.1`, `4.0.4`, `4.4.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2024 · Tags: Insecure deserialization
- [Deserialization of Untrusted Data in Apache Camel SQL](https://agentprime.io/advisories/GHSA-36xr-4x2f-cfj9.md)
  `GHSA-36xr-4x2f-cfj9`, `CVE-2024-22369` · Maven `org.apache.camel:camel-sql`: affected `>=3.0.0, <3.21.4 || >=3.22.0, <3.22.1 || >=4.0.0, <4.0.4 || >=4.1.0, <4.4.0`, fixed in `3.21.4`, `3.22.1`, `4.0.4`, `4.4.0` · CVSS 7.8 High · Not analysed yet · Published 20 Feb 2024 · Tags: Insecure deserialization
- [Liferay Portal and Liferay DXP vulnerable to theft of hashed password](https://agentprime.io/advisories/GHSA-xq4r-4xfh-vch8.md)
  `GHSA-xq4r-4xfh-vch8`, `CVE-2024-26270` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q3, <2023.Q3.5 || >=7.4.0, <=7.4.13.u92`, fixed in `2023.Q3.5` · CVSS 6.5 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Information disclosure
- [Liferay Portal and Liferay DXP User Enumeration Vulnerability](https://agentprime.io/advisories/GHSA-qm43-g2xj-hvg5.md)
  `GHSA-qm43-g2xj-hvg5`, `CVE-2024-26268` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp20 || >=7.3.0, <7.3.10.u8 || >=7.4.0, <7.4.13.u27`, fixed in `7.2.10.fp20`, `7.3.10.u8`, `7.4.13.u27` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Information disclosure
- [Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)](https://agentprime.io/advisories/GHSA-vvpf-53qx-cxhh.md)
  `GHSA-vvpf-53qx-cxhh`, `CVE-2024-25610` · Maven `com.liferay.portal:com.liferay.portal.web` and 2 more: affected `<5.0.96`, fixed in `5.0.96` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-1188
- [Liferay Portal and Liferay DXP HTTP Header Can Expose Versions](https://agentprime.io/advisories/GHSA-2mvj-q2q3-wxjv.md)
  `GHSA-2mvj-q2q3-wxjv`, `CVE-2024-26267` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp19 || >=7.3.0, <7.3.10.u5 || >=7.4.0, <7.4.13.u26`, fixed in `7.2.10.fp19`, `7.3.10.u5`, `7.4.13.u26` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-1188
- [Liferay Portal vulnerable to Denial of Service](https://agentprime.io/advisories/GHSA-29xx-fhff-36m7.md)
  `GHSA-29xx-fhff-36m7`, `CVE-2024-26265` · Maven `com.liferay.portal:release.portal.bom`: affected `<7.4.3.16`, fixed in `7.4.3.16` · CVSS 5.0 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTAyLTIwVDE1OjMxOjAzLjAwMDAwMFoiLCJHSFNBLTI5eHgtZmhmZi0zNm03Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTAzLTA2VDE4OjMwOjM5LjAwMDAwMFoiLCJHSFNBLXhqMzYtNnhjNi04cDl4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTAzLTA2VDE4OjMwOjM5LjAwMDAwMFoiLCJHSFNBLXhqMzYtNnhjNi04cDl4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.