# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Ant-Media-Server vulnerable to Improper Output Neutralization for Logs](https://agentprime.io/advisories/GHSA-2gx6-qrpp-c4p3.md)
  `GHSA-2gx6-qrpp-c4p3`, `CVE-2024-35371` · Maven `io.antmedia:ant-media-server`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 29 Nov 2024 · Tags: Memory corruption
- [Querydsl vulnerable to HQL injection through orderBy](https://agentprime.io/advisories/GHSA-6q3q-6v5j-h6vg.md)
  `GHSA-6q3q-6v5j-h6vg`, `CVE-2024-49203` · Maven `com.querydsl:querydsl-apt` and 3 more: affected `<=5.1.0`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 27 Nov 2024 · Tags: SQL injection
- [Jenkins Filesystem List Parameter Plugin has Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-fwxq-3f52-5cmc.md)
  `GHSA-fwxq-3f52-5cmc`, `CVE-2024-54004` · Maven `aendter.jenkins.plugins:filesystem-list-parameter-plugin`: affected `<0.0.15`, fixed in `0.0.15` · CVSS 4.3 Medium · Not analysed yet · Published 27 Nov 2024 · Tags: Path traversal
- [Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-4gwv-fpmg-cmv2.md)
  `GHSA-4gwv-fpmg-cmv2`, `CVE-2024-54003` · Maven `io.jenkins.plugins:simple-queue`: affected `<1.4.5`, fixed in `1.4.5` · CVSS 8.0 High · Critical (CVSS 7+ and EPSS) · EPSS 0.81 · Not analysed yet · Published 27 Nov 2024 · Tags: Cross-site scripting (XSS)
- [sigstore-java has vulnerability with bundle verification](https://agentprime.io/advisories/GHSA-q4xm-6fjc-5f6w.md)
  `GHSA-q4xm-6fjc-5f6w`, `CVE-2024-53267` · Maven `dev.sigstore:sigstore-java`: affected `>=1.0.0, <1.1.0`, fixed in `1.1.0` · CVSS 5.5 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Weak cryptography or TLS, CWE-345
- [Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination](https://agentprime.io/advisories/GHSA-93ww-43rr-79v3.md)
  `GHSA-93ww-43rr-79v3`, `CVE-2024-10039` · Maven `org.keycloak:keycloak-core`: affected `<26.0.6`, fixed in `26.0.6` · CVSS 7.1 High · Not analysed yet · Published 25 Nov 2024 · Tags: Weak cryptography or TLS
- [Keycloak proxy header handling Denial-of-Service (DoS) vulnerability](https://agentprime.io/advisories/GHSA-jgwc-jh89-rpgq.md)
  `GHSA-jgwc-jh89-rpgq`, `CVE-2024-9666` · Maven `org.keycloak:keycloak-quarkus-server`: affected `* || >=25.0.0, <26.0.6`, fixed in `26.0.6` · CVSS 4.7 Medium · Not analysed yet · Published 25 Nov 2024 · Tags: HTTP request smuggling
- [Keycloak Build Process Exposes Sensitive Data](https://agentprime.io/advisories/GHSA-v7gv-xpgf-6395.md)
  `GHSA-v7gv-xpgf-6395`, `CVE-2024-10451` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 5.9 Medium · Not analysed yet · Published 25 Nov 2024 · Tags: Hard-coded credentials
- [Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path](https://agentprime.io/advisories/GHSA-5545-r4hg-rj4m.md)
  `GHSA-5545-r4hg-rj4m`, `CVE-2024-10492` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<26.0.6 || >=25.0.0, <26.0.6`, fixed in `26.0.6` · CVSS 2.7 Low · Not analysed yet · Published 25 Nov 2024 · Tags: Path traversal
- [org.keycloak:keycloak-services has Inefficient Regular Expression Complexity](https://agentprime.io/advisories/GHSA-wq8x-cg39-8mrr.md)
  `GHSA-wq8x-cg39-8mrr`, `CVE-2024-10270` · Maven `org.keycloak:keycloak-services`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 6.5 Medium · Not analysed yet · Published 25 Nov 2024 · Tags: Denial of service
- [Duplicate Advisory: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability](https://agentprime.io/advisories/GHSA-pcx7-8hxg-j823.md)
  `GHSA-pcx7-8hxg-j823` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 4.7 Medium · Withdrawn · Not analysed yet · Published 25 Nov 2024 · Tags: HTTP request smuggling
- [Duplicate Advisory: Keycloak Build Process Exposes Sensitive Data](https://agentprime.io/advisories/GHSA-jcgg-mg9g-p9wf.md)
  `GHSA-jcgg-mg9g-p9wf` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 5.9 Medium · Withdrawn · Not analysed yet · Published 25 Nov 2024 · Tags: Hard-coded credentials
- [Duplicate Advisory: org.keycloak:keycloak-services has Inefficient Regular Expression Complexity](https://agentprime.io/advisories/GHSA-j3x3-r585-4qhg.md)
  `GHSA-j3x3-r585-4qhg` · Maven `org.keycloak:keycloak-services`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 25 Nov 2024 · Tags: Denial of service
- [Duplicate Advisory: Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path](https://agentprime.io/advisories/GHSA-6vrw-mpj8-3j59.md)
  `GHSA-6vrw-mpj8-3j59` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 2.7 Low · Withdrawn · Not analysed yet · Published 25 Nov 2024 · Tags: Path traversal
- [Searching Opencast may cause a denial of service](https://agentprime.io/advisories/GHSA-jh6x-7xfg-9cq2.md)
  `GHSA-jh6x-7xfg-9cq2`, `CVE-2024-52797` · Maven `org.opencastproject:opencast-elasticsearch-impl`: affected `>=11.4, <13.10 || >=14.0, <14.3 || >=15.0, <16.7`, fixed in `13.10`, `14.3`, `16.7` · CVSS 6.5 Medium · Not analysed yet · Published 20 Nov 2024 · Tags: Denial of service
- [Duplicate Advisory: Querydsl SQL/HQL injection](https://agentprime.io/advisories/GHSA-wpvf-5mc3-hv6m.md)
  `GHSA-wpvf-5mc3-hv6m` · Maven `com.querydsl:querydsl-apt` and 3 more: affected `<=5.1.0`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 20 Nov 2024 · Tags: SQL injection
- [Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider](https://agentprime.io/advisories/GHSA-2x2g-32r7-p4x8.md)
  `GHSA-2x2g-32r7-p4x8`, `CVE-2024-31141` · Maven `org.apache.kafka:kafka-clients`: affected `>=2.3.0, <3.7.1`, fixed in `3.7.1` · CVSS 6.5 Medium · Not analysed yet · Published 19 Nov 2024 · Tags: Privilege escalation, Information disclosure
- [Graylog concurrent PDF report rendering can leak other users' reports](https://agentprime.io/advisories/GHSA-vggm-3478-vm5m.md)
  `GHSA-vggm-3478-vm5m`, `CVE-2024-52506` · Maven `org.graylog:graylog-parent`: affected `>=6.1.0, <6.1.2`, fixed in `6.1.2` · CVSS 7.1 High · Not analysed yet · Published 18 Nov 2024 · Tags: Information disclosure
- [Apache Tomcat - XSS in generated JSPs](https://agentprime.io/advisories/GHSA-f632-9449-3j4w.md)
  `GHSA-f632-9449-3j4w`, `BIT-tomcat-2024-52318`, `CVE-2024-52318` · Maven `org.apache.tomcat.embed:tomcat-embed-jasper` and 2 more: affected `>=9.0.96, <9.0.97 || >=11.0.0, <11.0.1 || >=10.1.31, <10.1.32`, fixed in `9.0.97`, `11.0.1`, `10.1.32` · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: Weak cryptography or TLS
- [Apache Tomcat - Authentication Bypass](https://agentprime.io/advisories/GHSA-xcpr-7mr4-h4xq.md)
  `GHSA-xcpr-7mr4-h4xq`, `BIT-tomcat-2024-52316`, `CVE-2024-52316` · Maven `org.apache.tomcat:tomcat-catalina`: affected `<9.0.96 || >=10.1.0-M1, <10.1.30 || >=11.0.0-M1, <11.0.1`, fixed in `9.0.96`, `10.1.30`, `11.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2024 · Tags: CWE-391, CWE-754
- [Apache Tomcat Request and/or response mix-up](https://agentprime.io/advisories/GHSA-qvf5-hvjx-wm27.md)
  `GHSA-qvf5-hvjx-wm27`, `BIT-tomcat-2024-52317`, `CVE-2024-52317` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.92, <9.0.96 || >=10.1.27, <10.1.31 || >=11.0.0-M23, <11.0.0`, fixed in `9.0.96`, `10.1.31`, `11.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: Weak cryptography or TLS
- [Spring MVC controller vulnerable to a DoS attack](https://agentprime.io/advisories/GHSA-w3c8-7r8f-9jp8.md)
  `GHSA-w3c8-7r8f-9jp8`, `CVE-2024-38828` · Maven `org.springframework:spring-webmvc`: affected `>=5.3.0, <5.3.42`, fixed in `5.3.42` · CVSS 5.3 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: Denial of service
- [Debezium database connector has a script injection vulnerability](https://agentprime.io/advisories/GHSA-hvw5-3mgw-7rcf.md)
  `GHSA-hvw5-3mgw-7rcf`, `CVE-2023-1419` · Maven `io.debezium:debezium-connector-mysql` and 2 more: affected `<2.3.0.Alpha1`, fixed in `2.3.0.Alpha1` · CVSS 5.9 Medium · Not analysed yet · Published 17 Nov 2024 · Tags: CWE-233
- [Undertow incorrectly parses cookies](https://agentprime.io/advisories/GHSA-3jrv-jgp8-45v3.md)
  `GHSA-3jrv-jgp8-45v3`, `CVE-2023-4639` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Alpha1, <2.3.11.Final || <2.2.30.Final`, fixed in `2.3.11.Final`, `2.2.30.Final` · CVSS 7.4 High · Not analysed yet · Published 17 Nov 2024 · Tags: HTTP request smuggling
- [FitNesse Path Traversal](https://agentprime.io/advisories/GHSA-q297-5ff8-hc92.md)
  `GHSA-q297-5ff8-hc92`, `CVE-2024-42499` · Maven `org.fitnesse:fitnesse`: affected `<20241026`, fixed in `20241026` · CVSS 5.3 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Path traversal
- [FitNesse Cross-site scripting](https://agentprime.io/advisories/GHSA-pg82-9w35-3w3r.md)
  `GHSA-pg82-9w35-3w3r`, `CVE-2024-39610` · Maven `org.fitnesse:fitnesse`: affected `<20241026`, fixed in `20241026` · CVSS 6.1 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS)
- [Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin](https://agentprime.io/advisories/GHSA-p2qq-c693-q53w.md)
  `GHSA-p2qq-c693-q53w`, `CVE-2024-52551` · Maven `org.jenkinsci.plugins:pipeline-model-parent`: affected `<2.2218.v56d0cda`, fixed in `2.2218.v56d0cda` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2024 · Tags: Broken access control
- [Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin](https://agentprime.io/advisories/GHSA-mrpr-vr82-x88r.md)
  `GHSA-mrpr-vr82-x88r`, `CVE-2024-52550` · Maven `org.jenkins-ci.plugins.workflow:workflow-cps`: affected `<3993.v3e20a`, fixed in `3993.v3e20a` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2024 · Tags: Broken access control, CWE-354
- [Missing permission check in Jenkins Script Security Plugin](https://agentprime.io/advisories/GHSA-jv82-75fh-23r7.md)
  `GHSA-jv82-75fh-23r7`, `CVE-2024-52549` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1368.vb`, fixed in `1368.vb` · CVSS 4.3 Medium · Not analysed yet · Published 13 Nov 2024 · Tags: Authentication bypass, Broken access control
- [Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin](https://agentprime.io/advisories/GHSA-h23j-73ww-7594.md)
  `GHSA-h23j-73ww-7594`, `CVE-2024-52553` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<4.421.v5422614eb`, fixed in `4.421.v5422614eb` · CVSS 8.8 High · Not analysed yet · Published 13 Nov 2024 · Tags: Authentication bypass
- [Stored XSS vulnerability in Jenkins Authorize Project Plugin](https://agentprime.io/advisories/GHSA-8886-8v27-85j8.md)
  `GHSA-8886-8v27-85j8`, `CVE-2024-52552` · Maven `org.jenkins-ci.plugins:authorize-project`: affected `<1.8.0`, fixed in `1.8.0` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2024 · Tags: Cross-site scripting (XSS)
- [Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin](https://agentprime.io/advisories/GHSA-7845-crfj-phc4.md)
  `GHSA-7845-crfj-phc4`, `CVE-2024-52554` · Maven `io.jenkins.plugins:shared-library-version-override`: affected `<19.v3a`, fixed in `19.v3a` · CVSS 8.8 High · Not analysed yet · Published 13 Nov 2024 · Tags: Broken access control
- [Denial of Service attack on windows app using netty](https://agentprime.io/advisories/GHSA-xq3w-v528-46rv.md)
  `GHSA-xq3w-v528-46rv`, `CVE-2024-47535` · Maven `io.netty:netty-common`: affected `<4.1.115.Final`, fixed in `4.1.115.Final` · CVSS 5.5 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: Denial of service
- [powertac-server XML External Entity vulnerability](https://agentprime.io/advisories/GHSA-pgrc-8wp5-5mvq.md)
  `GHSA-pgrc-8wp5-5mvq`, `CVE-2024-51135` · Maven `org.powertac:server-interface`: affected `<=1.9.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Nov 2024 · Tags: Cross-site scripting (XSS)
- [XXE vulnerability in XSLT parsing in \`org.hl7.fhir.core\`](https://agentprime.io/advisories/GHSA-gr3c-q7xf-47vh.md)
  `GHSA-gr3c-q7xf-47vh`, `CVE-2024-52007` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` and 5 more: affected `<6.4.0`, fixed in `6.4.0` · CVSS 8.6 High · Not analysed yet · Published 8 Nov 2024 · Tags: XML external entities (XXE)
- [XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream](https://agentprime.io/advisories/GHSA-hfq9-hggm-c56q.md)
  `GHSA-hfq9-hggm-c56q`, `CVE-2024-47072` · Maven `com.thoughtworks.xstream:xstream`: affected `<1.4.21`, fixed in `1.4.21` · CVSS 7.5 High · Not analysed yet · Published 7 Nov 2024 · Tags: Memory corruption, Insecure deserialization
- [Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server](https://agentprime.io/advisories/GHSA-g93m-8x6h-g5gv.md)
  `GHSA-g93m-8x6h-g5gv`, `BIT-zookeeper-2024-51504`, `CVE-2024-51504` · Maven `org.apache.zookeeper:zookeeper`: affected `>=3.9.0, <3.9.3`, fixed in `3.9.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2024 · Tags: Authentication bypass
- [hibernate-validator Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-x83m-pf6f-pf9g.md)
  `GHSA-x83m-pf6f-pf9g`, `CVE-2023-1932` · Maven `org.hibernate:hibernate-validator` and 1 more: affected `<6.2.0.Final`, fixed in `6.2.0.Final` · CVSS 6.1 Medium · Not analysed yet · Published 7 Nov 2024 · Tags: Cross-site scripting (XSS)
- [Undertow Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-97cq-f4jm-mv8h.md)
  `GHSA-97cq-f4jm-mv8h`, `CVE-2023-1973` · Maven `io.undertow:undertow-core`: affected `<2.2.32.Final || >=2.3.0.Alpha1, <2.3.13.Final`, fixed in `2.2.32.Final`, `2.3.13.Final` · CVSS 7.5 High · Not analysed yet · Published 7 Nov 2024 · Tags: Denial of service, CWE-20
- [Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability](https://agentprime.io/advisories/GHSA-7jqf-v358-p8g7.md)
  `GHSA-7jqf-v358-p8g7`, `BIT-tomcat-2024-38286`, `CVE-2024-38286` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.0-M21 || >=10.1.0-M1, <10.1.25 || >=9.0.13, <9.0.90 || >=8.5.35, <=8.5.100 || >=7.0.92, <=7.0.109`, fixed in `11.0.0-M21`, `10.1.25`, `9.0.90` · CVSS 8.6 High · Not analysed yet · Published 7 Nov 2024 · Tags: Denial of service
- [HAPI FHIR XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-4cf2-cxp3-rjr7.md)
  `GHSA-4cf2-cxp3-rjr7`, `CVE-2024-51132` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.convertors` and 8 more: affected `<6.4.0`, fixed in `6.4.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2024 · Tags: Open redirect, XML external entities (XXE)
- [Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (\`GHSL-2024-074\`)](https://agentprime.io/advisories/GHSA-82j3-hf72-7x93.md)
  `GHSA-82j3-hf72-7x93`, `CVE-2024-36117` · Maven `com.reposilite:reposilite-backend`: affected `>=3.3.0, <3.5.12`, fixed in `3.5.12` · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2024 · Tags: Path traversal
- [hornetq vulnerable to file overwrite, sensitive information disclosure](https://agentprime.io/advisories/GHSA-r7mv-mv7m-pjw3.md)
  `GHSA-r7mv-mv7m-pjw3`, `CVE-2024-51127` · Maven `org.hornetq:hornetq-core-client`: affected `<=2.4.9`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2024 · Tags: Path traversal, Information disclosure
- [Apache Kylin Session Fixation vulnerability](https://agentprime.io/advisories/GHSA-752q-72qc-rc66.md)
  `GHSA-752q-72qc-rc66`, `CVE-2024-23590` · Maven `org.apache.kylin:kylin`: affected `>=2.0.0, <5.0.0`, fixed in `5.0.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2024 · Tags: Authentication bypass
- [JeecgBoot SQL Injection vulnerability](https://agentprime.io/advisories/GHSA-mcw3-h5xg-r95m.md)
  `GHSA-mcw3-h5xg-r95m`, `CVE-2024-48307` · Maven `org.jeecgframework.boot:jeecg-boot-parent`: affected `<=3.7.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.50 · Not analysed yet · Published 31 Oct 2024 · Tags: SQL injection
- [Snowflake JDBC Security Advisory](https://agentprime.io/advisories/GHSA-f686-hw9c-xw9c.md)
  `GHSA-f686-hw9c-xw9c`, `CVE-2024-43382` · Maven `net.snowflake:snowflake-jdbc`: affected `>=3.2.6, <3.20.0`, fixed in `3.20.0` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2024 · Tags: Weak cryptography or TLS
- [Apache NiFi Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-7mqj-xgf8-p59v.md)
  `GHSA-7mqj-xgf8-p59v`, `BIT-nifi-2024-45477`, `CVE-2024-45477` · Maven `org.apache.nifi:nifi-web-ui`: affected `>=1.10.0, <1.28.0 || >=2.0.0-M1, <2.0.0-M4`, fixed in `1.28.0`, `2.0.0-M4` · CVSS 4.6 Medium · Not analysed yet · Published 29 Oct 2024 · Tags: Cross-site scripting (XSS)
- [MPXJ has a Potential Path Traversal Vulnerability](https://agentprime.io/advisories/GHSA-j945-c44v-97g6.md)
  `GHSA-j945-c44v-97g6`, `CVE-2024-49771`, `PYSEC-2026-1681` · Maven `net.sf.mpxj:mpxj` and 6 more: affected `>=8.3.5, <13.5.1`, fixed in `13.5.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2024 · Tags: Path traversal
- [Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications](https://agentprime.io/advisories/GHSA-c4q5-6c82-3qpw.md)
  `GHSA-c4q5-6c82-3qpw`, `CVE-2024-38821` · Maven `org.springframework.security:spring-security-web`: affected `>=5.0.0, <5.7.13 || >=5.8.0, <5.8.15 || >=6.2.0, <6.2.7 || >=6.0.0, <6.0.13 || >=6.1.0, <6.1.11 || >=6.3.0, <6.3.4`, fixed in `5.7.13`, `5.8.15`, `6.2.7`, `6.0.13`, `6.1.11`, `6.3.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2024 · Tags: Broken access control, Denial of service
- [OpenRefine has a path traversal in LoadLanguageCommand](https://agentprime.io/advisories/GHSA-qfwq-6jh6-8xx4.md)
  `GHSA-qfwq-6jh6-8xx4`, `CVE-2024-49760` · Maven `org.openrefine:openrefine`: affected `<3.8.3`, fixed in `3.8.3` · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2024 · Tags: Path traversal
- [OpenRefine leaks Google API credentials in releases](https://agentprime.io/advisories/GHSA-3pg4-qwc8-426r.md)
  `GHSA-3pg4-qwc8-426r` · Maven `org.openrefine:openrefine`: affected `<3.8.3`, fixed in `3.8.3` · No CVSS score · Not analysed yet · Published 24 Oct 2024 · Tags: Hard-coded credentials
- [Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)](https://agentprime.io/advisories/GHSA-mpcw-3j5p-p99x.md)
  `GHSA-mpcw-3j5p-p99x` · Maven `org.openrefine.dependencies:butterfly`: affected `<1.2.6`, fixed in `1.2.6` · No CVSS score · Not analysed yet · Published 24 Oct 2024 · Tags: Code injection, CWE-185
- [Butterfly has path/URL confusion in resource handling leading to multiple weaknesses](https://agentprime.io/advisories/GHSA-3p8v-w8mr-m3x8.md)
  `GHSA-3p8v-w8mr-m3x8`, `CVE-2024-47883` · Maven `org.openrefine.dependencies:butterfly`: affected `<1.2.6`, fixed in `1.2.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2024 · Tags: Path traversal, Server-side request forgery (SSRF)
- [OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project](https://agentprime.io/advisories/GHSA-j8hp-f2mj-586g.md)
  `GHSA-j8hp-f2mj-586g`, `CVE-2024-47882` · Maven `org.openrefine:openrefine`: affected `<3.8.3`, fixed in `3.8.3` · CVSS 5.9 Medium · Not analysed yet · Published 24 Oct 2024 · Tags: Cross-site scripting (XSS), CWE-81
- [OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)](https://agentprime.io/advisories/GHSA-87cf-j763-vvh8.md)
  `GHSA-87cf-j763-vvh8`, `CVE-2024-47881` · Maven `org.openrefine:database`: affected `>=3.4-beta, <3.8.3`, fixed in `3.8.3` · CVSS 8.1 High · Not analysed yet · Published 24 Oct 2024 · Tags: SQL injection
- [OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand](https://agentprime.io/advisories/GHSA-79jv-5226-783f.md)
  `GHSA-79jv-5226-783f`, `CVE-2024-47880` · Maven `org.openrefine:openrefine`: affected `<3.8.3`, fixed in `3.8.3` · CVSS 8.1 High · Not analysed yet · Published 24 Oct 2024 · Tags: Cross-site scripting (XSS), CWE-348
- [OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)](https://agentprime.io/advisories/GHSA-3jm4-c6qf-jrh3.md)
  `GHSA-3jm4-c6qf-jrh3`, `CVE-2024-47879` · Maven `org.openrefine:main`: affected `<3.8.3`, fixed in `3.8.3` · CVSS 7.6 High · Not analysed yet · Published 24 Oct 2024 · Tags: Code injection, Cross-site request forgery (CSRF)
- [OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)](https://agentprime.io/advisories/GHSA-pw3x-c5vp-mfc3.md)
  `GHSA-pw3x-c5vp-mfc3`, `CVE-2024-47878` · Maven `org.openrefine:extensions`: affected `<3.8.3`, fixed in `3.8.3` · CVSS 8.1 High · Not analysed yet · Published 24 Oct 2024 · Tags: Cross-site scripting (XSS)
- [Apache Syncope: Stored XSS in Console and Enduser](https://agentprime.io/advisories/GHSA-jmrf-85g8-x8xv.md)
  `GHSA-jmrf-85g8-x8xv`, `CVE-2024-45031` · Maven `org.apache.syncope.client:syncope-client-console`: affected `>=2.1.0, <=2.1.14`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 24 Oct 2024 · Tags: Cross-site scripting (XSS), CWE-20
- [Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor](https://agentprime.io/advisories/GHSA-p63m-vmjr-wg37.md)
  `GHSA-p63m-vmjr-wg37`, `CVE-2024-26272` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2023.Q4.0, <2023.Q4.3 || >=2023.Q3.1, <2023.Q3.6 || >=7.3.GA, <7.3u36 || >=7.4.GA, <7.4u93`, fixed in `2023.Q4.3`, `2023.Q3.6`, `7.3u36`, `7.4u93` · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2024 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTEwLTIyVDE4OjMyOjExLjAwMDAwMFoiLCJHSFNBLXA2M20tdm1qci13ZzM3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI0LTEyLTAyVDE1OjMxOjQxLjAwMDAwMFoiLCJHSFNBLXEzdjYtaG0ydi1wdzk5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI0LTEyLTAyVDE1OjMxOjQxLjAwMDAwMFoiLCJHSFNBLXEzdjYtaG0ydi1wdzk5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.