# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor](https://agentprime.io/advisories/GHSA-hmrx-6pr5-hpwj.md)
  `GHSA-hmrx-6pr5-hpwj`, `CVE-2024-26273` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q4.0, <2023.Q4.3 || >=2023.Q3.1, <2023.Q3.6 || >=7.4.GA, <7.4u93 || >=7.3u29, <7.3u36`, fixed in `2023.Q4.3`, `2023.Q3.6`, `7.4u93`, `7.3u36` · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2024 · Tags: Cross-site request forgery (CSRF)
- [Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console](https://agentprime.io/advisories/GHSA-chj2-4vg7-hhg3.md)
  `GHSA-chj2-4vg7-hhg3`, `CVE-2024-8980` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q3.1, <2023.Q3.5 || >=7.0.0-GA, <=7.0.10.fp102 || >=7.1.0-GA, <=7.1.10.fp28 || >=7.2.0.GA, <=7.2.10.fp20 || >=7.3.0-GA, <7.3.10.u36 || >=7.4.0-GA, <=7.4.13.u92`, fixed in `2023.Q3.5`, `7.3.10.u36` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2024 · Tags: Cross-site request forgery (CSRF)
- [Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget](https://agentprime.io/advisories/GHSA-6c4v-x9v2-rjm8.md)
  `GHSA-6c4v-x9v2-rjm8`, `CVE-2024-26271` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q4.0, <2023.Q4.3 || >=2023.Q3.1, <2023.Q3.6 || >=7.3u32, <7.3u37 || >=7.4u75, <7.4u93`, fixed in `2023.Q4.3`, `2023.Q3.6`, `7.3u37`, `7.4u93` · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2024 · Tags: Cross-site request forgery (CSRF)
- [Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions](https://agentprime.io/advisories/GHSA-3mfq-fp2f-vwqh.md)
  `GHSA-3mfq-fp2f-vwqh`, `CVE-2024-38002` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q4.0, <2023.Q4.6 || >=2023.Q3.1, <2023.Q3.9 || >=7.3-ga, <7.3.10.u36 || >=7.4-ga, <7.4.13.u92`, fixed in `2023.Q4.6`, `2023.Q3.9`, `7.3.10.u36`, `7.4.13.u92` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2024 · Tags: Broken access control
- [Spring Framework DataBinder Case Sensitive Match Exception](https://agentprime.io/advisories/GHSA-4gc7-5j7h-4qph.md)
  `GHSA-4gc7-5j7h-4qph`, `CVE-2024-38820` · Maven `org.springframework:spring-context` and 1 more: affected `>=6.1.0, <6.1.14 || >=6.0.0, <=6.0.24 || <=5.3.40`, fixed in `6.1.14` · CVSS 3.1 Low · Not analysed yet · Published 18 Oct 2024 · Tags: CWE-178
- [JetBrains Ktor information disclosure](https://agentprime.io/advisories/GHSA-8qv4-773j-c979.md)
  `GHSA-8qv4-773j-c979`, `CVE-2024-49580` · Maven `io.ktor:ktor-client-core-jvm`: affected `<2.3.13`, fixed in `2.3.13` · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2024 · Tags: CWE-524
- [Improper Authentication vulnerability in Apache Solr](https://agentprime.io/advisories/GHSA-mjvf-4h88-6xm3.md)
  `GHSA-mjvf-4h88-6xm3`, `BIT-solr-2024-45216`, `CVE-2024-45216` · Maven `org.apache.solr:solr`: affected `>=5.3.0, <8.11.4 || >=9.0.0, <9.7.0`, fixed in `8.11.4`, `9.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.93 · Not analysed yet · Published 16 Oct 2024 · Tags: Authentication bypass, Broken access control
- [Insecure Default Initialization of Resource vulnerability in Apache Solr](https://agentprime.io/advisories/GHSA-h7w9-c5vx-x7j3.md)
  `GHSA-h7w9-c5vx-x7j3`, `BIT-solr-2024-45217`, `CVE-2024-45217` · Maven `org.apache.solr:solr`: affected `>=6.6.0, <8.11.4 || >=9.0.0, <9.7.0`, fixed in `8.11.4`, `9.7.0` · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-1188
- [SAK-50571 Sakai Kernel users created with type roleview can login as a normal user](https://agentprime.io/advisories/GHSA-cx95-q6gx-w4qp.md)
  `GHSA-cx95-q6gx-w4qp`, `CVE-2024-47876` · Maven `org.sakaiproject.kernel:sakai-kernel-impl`: affected `>=23.0, <23.3`, fixed in `23.3` · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2024 · Tags: Broken access control
- [Eclipse Jetty URI parsing of invalid authority](https://agentprime.io/advisories/GHSA-qh8g-58pp-2wxh.md)
  `GHSA-qh8g-58pp-2wxh`, `CVE-2024-6763` · Maven `org.eclipse.jetty:jetty-http`: affected `>=7.0.0, <12.0.12`, fixed in `12.0.12` · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-1286
- [Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks](https://agentprime.io/advisories/GHSA-g8m5-722r-8whq.md)
  `GHSA-g8m5-722r-8whq`, `CVE-2024-8184` · Maven `org.eclipse.jetty:jetty-server`: affected `>=12.0.0, <12.0.9 || >=10.0.0, <10.0.24 || >=11.0.0, <11.0.24 || >=9.3.12, <9.4.56`, fixed in `12.0.9`, `10.0.24`, `11.0.24`, `9.4.56` · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Denial of service
- [Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks](https://agentprime.io/advisories/GHSA-r7m4-f9h5-gr79.md)
  `GHSA-r7m4-f9h5-gr79`, `CVE-2024-6762` · Maven `org.eclipse.jetty:jetty-servlets`: affected `>=10.0.0, <10.0.18 || >=11.0.0, <11.0.18 || >=12.0.0, <12.0.4`, fixed in `10.0.18`, `11.0.18`, `12.0.4` · CVSS 3.1 Low · Not analysed yet · Published 14 Oct 2024 · Tags: Denial of service
- [Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity](https://agentprime.io/advisories/GHSA-xmmm-jw76-q7vg.md)
  `GHSA-xmmm-jw76-q7vg`, `BIT-keycloak-2024-7318`, `CVE-2024-7318` · Maven `org.keycloak:keycloak-core`: affected `<24.0.7 || >=25.0.0, <25.0.4`, fixed in `24.0.7`, `25.0.4` · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-324
- [Keycloak has session fixation in Elytron SAML adapters](https://agentprime.io/advisories/GHSA-5rxp-2rhr-qwqv.md)
  `GHSA-5rxp-2rhr-qwqv`, `BIT-keycloak-2024-7341`, `CVE-2024-7341`, `GHSA-j76j-rqwj-jmvv` · Maven `org.keycloak:keycloak-services`: affected `<22.0.12 || >=23.0.0, <24.0.7 || >=25.0.0, <25.0.5`, fixed in `22.0.12`, `24.0.7`, `25.0.5` · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2024 · Tags: Authentication bypass
- [Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect](https://agentprime.io/advisories/GHSA-w8gr-xwp4-r9f7.md)
  `GHSA-w8gr-xwp4-r9f7`, `CVE-2024-8883` · Maven `org.keycloak:keycloak-services`: affected `<22.0.13 || >=23.0.0, <24.0.8 || >=25.0.0, <25.0.6`, fixed in `22.0.13`, `24.0.8`, `25.0.6` · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Open redirect
- [Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak](https://agentprime.io/advisories/GHSA-xgfv-xpx8-qhcr.md)
  `GHSA-xgfv-xpx8-qhcr`, `CVE-2024-8698` · Maven `org.keycloak:keycloak-saml-core`: affected `<22.0.13 || >=23.0.0, <24.0.8 || >=25.0.0, <25.0.6`, fixed in `22.0.13`, `24.0.8`, `25.0.6` · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2024 · Tags: Weak cryptography or TLS
- [Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans](https://agentprime.io/advisories/GHSA-443j-grxv-2pgv.md)
  `GHSA-443j-grxv-2pgv`, `CVE-2023-50780` · Maven `org.apache.activemq:artemis-cli`: affected `<2.29.0`, fixed in `2.29.0` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 14 Oct 2024 · Tags: Broken access control
- [Eclipse Jetty has a denial of service vulnerability on DosFilter](https://agentprime.io/advisories/GHSA-j26w-f9rq-mr2q.md)
  `GHSA-j26w-f9rq-mr2q`, `CVE-2024-9823`, `GHSA-7hcf-ppf8-5w5h` · Maven `org.eclipse.jetty.ee10:jetty-ee10-servlets` and 3 more: affected `>=12.0.0, <12.0.3`, fixed in `12.0.3` · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Denial of service
- [pac4j-core affected by a Java deserialization vulnerability](https://agentprime.io/advisories/GHSA-76mw-6p95-x9x5.md)
  `GHSA-76mw-6p95-x9x5`, `CVE-2023-25581` · Maven `org.pac4j:pac4j-core`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2024 · Tags: Insecure deserialization
- [JSONPath Plus Remote Code Execution (RCE) Vulnerability](https://agentprime.io/advisories/GHSA-pppg-cpfq-h7wr.md)
  `GHSA-pppg-cpfq-h7wr`, `CVE-2024-21534` · Maven `org.webjars.npm:jsonpath-plus` and 1 more: affected `<=6.0.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2024 · Tags: Code injection
- [Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability](https://agentprime.io/advisories/GHSA-jqfv-jrvq-95jm.md)
  `GHSA-jqfv-jrvq-95jm`, `CVE-2024-28168` · Maven `org.apache.xmlgraphics:fop-core`: affected `<2.10`, fixed in `2.10` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2024 · Tags: XML external entities (XXE)
- [Quarkus CXF logs passwords and other secrets](https://agentprime.io/advisories/GHSA-jqh2-ch7p-xwxh.md)
  `GHSA-jqh2-ch7p-xwxh`, `CVE-2024-9621` · Maven `io.quarkiverse.cxf:quarkus-cxf`: affected `<3.15.2`, fixed in `3.15.2` · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2024 · Tags: Information disclosure
- [HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4](https://agentprime.io/advisories/GHSA-5wpr-cj9p-959r.md)
  `GHSA-5wpr-cj9p-959r`, `CVE-2024-9622` · Maven `org.jboss.resteasy:resteasy-netty4-cdi`: affected `*`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2024 · Tags: HTTP request smuggling
- [JSON-lib mishandles an unbalanced comment string](https://agentprime.io/advisories/GHSA-wwcp-26wc-3fxm.md)
  `GHSA-wwcp-26wc-3fxm`, `CVE-2024-47855` · Maven `net.sf.json-lib:json-lib` and 1 more: affected `<=2.4`, no fixed version yet · CVSS 5.3 Medium · EPSS 0.18 · Not analysed yet · Published 4 Oct 2024
- [Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)](https://agentprime.io/advisories/GHSA-r7pg-v2c8-mfg3.md)
  `GHSA-r7pg-v2c8-mfg3`, `CVE-2024-47561` · Maven `org.apache.avro:avro`: affected `<1.11.4`, fixed in `1.11.4` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2024 · Tags: Insecure deserialization
- [Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader](https://agentprime.io/advisories/GHSA-78wr-2p64-hpwj.md)
  `GHSA-78wr-2p64-hpwj`, `CVE-2024-47554` · Maven `commons-io:commons-io`: affected `>=2.0, <2.14.0`, fixed in `2.14.0` · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2024 · Tags: Denial of service
- [Jenkins exposes multi-line secrets through error messages](https://agentprime.io/advisories/GHSA-pj95-ph4q-4qm4.md)
  `GHSA-pj95-ph4q-4qm4`, `BIT-jenkins-2024-47803`, `CVE-2024-47803` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.462.3 || >=2.466, <2.479`, fixed in `2.462.3`, `2.479` · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: Information disclosure
- [Jenkins item creation restriction bypass vulnerability](https://agentprime.io/advisories/GHSA-f9qj-77q2-h5c5.md)
  `GHSA-f9qj-77q2-h5c5`, `BIT-jenkins-2024-47804`, `CVE-2024-47804` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.462.3 || >=2.466, <2.479`, fixed in `2.462.3`, `2.479` · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: Memory corruption, Broken access control
- [Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation](https://agentprime.io/advisories/GHSA-8pjw-fff6-3mjv.md)
  `GHSA-8pjw-fff6-3mjv`, `CVE-2024-47807` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<4.355.v3a`, fixed in `4.355.v3a` · CVSS 8.1 High · Not analysed yet · Published 2 Oct 2024 · Tags: Authentication bypass
- [Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission](https://agentprime.io/advisories/GHSA-62jv-j4w7-5hh8.md)
  `GHSA-62jv-j4w7-5hh8`, `CVE-2024-47805` · Maven `org.jenkins-ci.plugins:credentials`: affected `>=1372, <1381.v2c3a || <1371.1373.v4eb`, fixed in `1381.v2c3a`, `1371.1373.v4eb` · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: Information disclosure, Hard-coded credentials
- [Jenkins OpenId Connect Authentication Plugin lacks audience claim validation](https://agentprime.io/advisories/GHSA-49hx-9mm2-7675.md)
  `GHSA-49hx-9mm2-7675`, `CVE-2024-47806` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<4.355.v3a`, fixed in `4.355.v3a` · CVSS 8.1 High · Not analysed yet · Published 2 Oct 2024 · Tags: Authentication bypass
- [Eclipse Glassfish improperly handles http parameters](https://agentprime.io/advisories/GHSA-jq3f-mfmg-747x.md)
  `GHSA-jq3f-mfmg-747x`, `CVE-2024-9329` · Maven `org.glassfish.main.admin:rest-service`: affected `<7.0.17`, fixed in `7.0.17` · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2024 · Tags: Open redirect, CWE-233
- [Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.](https://agentprime.io/advisories/GHSA-g643-xq6w-r67c.md)
  `GHSA-g643-xq6w-r67c`, `CVE-2024-45772` · Maven `org.apache.lucene:lucene-replicator`: affected `>=4.4.0, <9.12.0`, fixed in `9.12.0` · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2024 · Tags: Insecure deserialization
- [Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials](https://agentprime.io/advisories/GHSA-2qq7-fch2-phqf.md)
  `GHSA-2qq7-fch2-phqf`, `CVE-2024-47197` · Maven `org.apache.maven.plugins:maven-archetype-plugin`: affected `>=3.2.1, <3.3.0`, fixed in `3.3.0` · CVSS 3.1 Low · Not analysed yet · Published 26 Sept 2024 · Tags: Information disclosure
- [Apache Hadoop: Temporary File Local Information Disclosure](https://agentprime.io/advisories/GHSA-f5fw-25gw-5m92.md)
  `GHSA-f5fw-25gw-5m92`, `CVE-2024-23454` · Maven `org.apache.hadoop:hadoop-common`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 3.3 Low · Not analysed yet · Published 25 Sept 2024 · Tags: Privilege escalation, CWE-378
- [Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability](https://agentprime.io/advisories/GHSA-6gch-63wp-4v5f.md)
  `GHSA-6gch-63wp-4v5f`, `CVE-2024-39928` · Maven `org.apache.linkis:linkis-engineplugin-spark`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2024 · Tags: Weak cryptography or TLS
- [Spring Framework DoS via conditional HTTP request](https://agentprime.io/advisories/GHSA-2rmj-mq67-h97g.md)
  `GHSA-2rmj-mq67-h97g`, `CVE-2024-38809` · Maven `org.springframework:spring-web`: affected `<5.3.38 || >=6.0.0, <6.0.23 || >=6.1.0, <6.1.12`, fixed in `5.3.38`, `6.0.23`, `6.1.12` · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2024 · Tags: Denial of service
- [DataEase has an XML External Entity Reference vulnerability](https://agentprime.io/advisories/GHSA-4m9p-7xg6-f4mm.md)
  `GHSA-4m9p-7xg6-f4mm`, `CVE-2024-46985` · Maven `io.dataease:common`: affected `<2.10.1`, fixed in `2.10.1` · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2024 · Tags: XML external entities (XXE)
- [DataEase's H2 datasource has a remote command execution risk](https://agentprime.io/advisories/GHSA-h7mj-m72h-qm8w.md)
  `GHSA-h7mj-m72h-qm8w`, `CVE-2024-46997` · Maven `io.dataease:common`: affected `<2.10.1`, fixed in `2.10.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2024 · Tags: Other injection
- [Duplicate Advisory: Keycloak Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-vvf8-2h68-9475.md)
  `GHSA-vvf8-2h68-9475` · Maven `org.keycloak:keycloak-services`: affected `<25.0.6`, fixed in `25.0.6` · CVSS 6.8 Medium · Withdrawn · Not analysed yet · Published 19 Sept 2024 · Tags: Open redirect
- [Duplicate Advisory: Keycloak SAML signature validation flaw](https://agentprime.io/advisories/GHSA-4xx7-2cx3-x473.md)
  `GHSA-4xx7-2cx3-x473` · Maven `org.keycloak:keycloak-saml-core`: affected `<25.0.6`, fixed in `25.0.6` · CVSS 7.7 High · Withdrawn · Not analysed yet · Published 19 Sept 2024 · Tags: Weak cryptography or TLS
- [protobuf-java has potential Denial of Service issue](https://agentprime.io/advisories/GHSA-735f-pc8j-v9w8.md)
  `GHSA-735f-pc8j-v9w8`, `CVE-2024-7254` · Maven `com.google.protobuf:protobuf-java` and 4 more: affected `<3.25.5 || >=4.0.0-RC1, <4.27.5 || >=4.28.0-RC1, <4.28.2`, fixed in `3.25.5`, `4.27.5`, `4.28.2` · CVSS 8.7 High · Not analysed yet · Published 19 Sept 2024 · Tags: Denial of service, Memory corruption, CWE-20
- [Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack](https://agentprime.io/advisories/GHSA-68j8-fp38-p48q.md)
  `GHSA-68j8-fp38-p48q`, `CVE-2024-46984` · Maven `de.gematik.refv.commons:commons`: affected `<2.5.1`, fixed in `2.5.1` · CVSS 8.6 High · Not analysed yet · Published 19 Sept 2024 · Tags: XML external entities (XXE)
- [SOFA Hessian Remote Command Execution (RCE) Vulnerability](https://agentprime.io/advisories/GHSA-c459-2m73-67hj.md)
  `GHSA-c459-2m73-67hj`, `CVE-2024-46983` · Maven `com.alipay.sofa:hessian`: affected `<3.5.5`, fixed in `3.5.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2024 · Tags: Other injection, Insecure deserialization
- [org.xwiki.platform:xwiki-platform-notifications-ui leaks data of notification filters of users](https://agentprime.io/advisories/GHSA-pg4m-3gp6-hw4w.md)
  `GHSA-pg4m-3gp6-hw4w`, `CVE-2024-46979` · Maven `org.xwiki.platform:xwiki-platform-notifications-ui`: affected `>=13.2-rc-1, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.1`, fixed in `14.10.21`, `15.5.5`, `15.10.1` · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2024 · Tags: Information disclosure
- [org.xwiki.platform:xwiki-platform-notifications-ui is missing checks for notification filter preferences editions](https://agentprime.io/advisories/GHSA-r95w-889q-x2gx.md)
  `GHSA-r95w-889q-x2gx`, `CVE-2024-46978` · Maven `org.xwiki.platform:xwiki-platform-notifications-ui`: affected `>=13.2-rc-1, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.1`, fixed in `14.10.21`, `15.5.5`, `15.10.1` · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-648
- [Keycloak Services has a potential bypass of brute force protection](https://agentprime.io/advisories/GHSA-gc7q-jgjv-vjr2.md)
  `GHSA-gc7q-jgjv-vjr2`, `BIT-keycloak-2024-4629`, `CVE-2024-4629` · Maven `org.keycloak:keycloak-services`: affected `<22.0.12 || >=23.0.0, <24.0.7 || >=25.0.0, <25.0.4`, fixed in `22.0.12`, `24.0.7`, `25.0.4` · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2024 · Tags: Authentication bypass, CWE-837
- [druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability](https://agentprime.io/advisories/GHSA-p72w-r6fv-6g5h.md)
  `GHSA-p72w-r6fv-6g5h`, `CVE-2024-45384` · Maven `org.apache.druid.extensions:druid-pac4j`: affected `>=0.18.0, <30.0.1`, fixed in `30.0.1` · CVSS 3.7 Low · Not analysed yet · Published 17 Sept 2024 · Tags: Information disclosure, Weak cryptography or TLS
- [Apache Druid: Users can provide MySQL JDBC properties not on allow list](https://agentprime.io/advisories/GHSA-jh66-3545-vpm7.md)
  `GHSA-jh66-3545-vpm7`, `CVE-2024-45537` · Maven `org.apache.druid:druid`: affected `<30.0.1`, fixed in `30.0.1` · CVSS 3.1 Low · Not analysed yet · Published 17 Sept 2024 · Tags: CWE-20
- [hermes-management is vulnerable to RCE due to Apache commons-jxpath](https://agentprime.io/advisories/GHSA-2gh6-wc3m-g37f.md)
  `GHSA-2gh6-wc3m-g37f` · Maven `pl.allegro.tech.hermes:hermes-management`: affected `>=0.8.2, <2.2.9`, fixed in `2.2.9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2024 · Tags: CWE-1395
- [OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries](https://agentprime.io/advisories/GHSA-hv38-h5pj-c96j.md)
  `GHSA-hv38-h5pj-c96j`, `CVE-2024-46942` · Maven `org.opendaylight.mdsal:mdsal-artifacts`: affected `<=13.0.1`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: Broken access control
- [OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability](https://agentprime.io/advisories/GHSA-46hr-3cq3-mcgp.md)
  `GHSA-46hr-3cq3-mcgp`, `CVE-2024-46943` · Maven `org.opendaylight.aaa:aaa-artifacts`: affected `<=0.19.3`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: Broken access control, Authentication bypass, CWE-520
- [Apache Seata Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-3xq2-w6j4-c99r.md)
  `GHSA-3xq2-w6j4-c99r`, `CVE-2024-22399` · Maven `org.apache.seata:seata-core`: affected `>=2.0.0, <2.1.0 || >=1.0.0, <1.8.1`, fixed in `2.1.0`, `1.8.1` · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2024 · Tags: Insecure deserialization
- [Path traversal vulnerability in functional web frameworks](https://agentprime.io/advisories/GHSA-cx7f-g6mp-7hqm.md)
  `GHSA-cx7f-g6mp-7hqm`, `CVE-2024-38816` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=6.1.0, <6.1.13 || >=6.0.0, <=6.0.23 || >=5.3.0, <=5.3.39`, fixed in `6.1.13` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 13 Sept 2024 · Tags: Path traversal
- [Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit](https://agentprime.io/advisories/GHSA-8259-2x72-2gvc.md)
  `GHSA-8259-2x72-2gvc`, `CVE-2024-8642` · Maven `org.eclipse.edc:transfer-data-plane`: affected `>=0.5.0, <0.9.0`, fixed in `0.9.0` · CVSS 5.0 Medium · Not analysed yet · Published 11 Sept 2024 · Tags: Authentication bypass, CWE-305
- [Eclipse Glassfish URL redirection vulnerability](https://agentprime.io/advisories/GHSA-7gq2-vwq9-w8vw.md)
  `GHSA-7gq2-vwq9-w8vw`, `CVE-2024-8646` · Maven `org.glassfish.main.web:web-core`: affected `<7.0.10`, fixed in `7.0.10` · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2024 · Tags: Open redirect
- [Keycloak Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-w97f-w3hq-36g2.md)
  `GHSA-w97f-w3hq-36g2`, `CVE-2023-6841` · Maven `org.keycloak:keycloak-core`: affected `<24.0.0`, fixed in `24.0.0` · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-231
- [XWiki Platform document history including authors of any page exposed to unauthorized actors](https://agentprime.io/advisories/GHSA-pvmm-55r5-g3mm.md)
  `GHSA-pvmm-55r5-g3mm`, `CVE-2024-45591` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=1.8.0, <15.10.9 || >=16.0.0-rc-1, <16.3.0-rc-1`, fixed in `15.10.9`, `16.3.0-rc-1` · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Information disclosure, Broken access control
- [Keycloak Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-g4gc-rh26-m3p5.md)
  `GHSA-g4gc-rh26-m3p5`, `BIT-keycloak-2024-7260`, `CVE-2024-7260` · Maven `org.keycloak:keycloak-core`: affected `<24.0.7`, fixed in `24.0.7` · CVSS 6.1 Medium · Not analysed yet · Published 9 Sept 2024 · Tags: Open redirect
- [Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date](https://agentprime.io/advisories/GHSA-57rh-gr4v-j5f6.md)
  `GHSA-57rh-gr4v-j5f6` · Maven `org.keycloak:keycloak-core`: affected `<24.0.7`, fixed in `24.0.7` · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 9 Sept 2024 · Tags: CWE-324

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTA5LTA5VDIxOjMxOjIyLjAwMDAwMFoiLCJHSFNBLTU3cmgtZ3I0di1qNWY2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTEwLTIyVDE4OjMyOjExLjAwMDAwMFoiLCJHSFNBLXA2M20tdm1qci13ZzM3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTEwLTIyVDE4OjMyOjExLjAwMDAwMFoiLCJHSFNBLXA2M20tdm1qci13ZzM3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.