# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [CSRF vulnerability in Jenkins Azure Service Fabric Plugin](https://agentprime.io/advisories/GHSA-wh3h-j8wp-6p42.md)
  `GHSA-wh3h-j8wp-6p42`, `CVE-2025-24402` · Maven `org.jenkins-ci.plugins:service-fabric`: affected `<=1.6`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Cross-site request forgery (CSRF)
- [Missing permission checks in Jenkins Azure Service Fabric Plugin](https://agentprime.io/advisories/GHSA-gp8p-49gr-jv8j.md)
  `GHSA-gp8p-49gr-jv8j`, `CVE-2025-24403` · Maven `org.jenkins-ci.plugins:service-fabric`: affected `<=1.6`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Broken access control
- [Disabled permissions can be granted by Folder-based in Jenkins Authorization Strategy Plugin](https://agentprime.io/advisories/GHSA-969g-rq57-c79h.md)
  `GHSA-969g-rq57-c79h`, `CVE-2025-24401` · Maven `io.jenkins.plugins:folder-auth`: affected `<=217.vd5b`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Broken access control
- [Incorrect permission check in Jenkins GitLab Plugin allows enumerating credentials IDs](https://agentprime.io/advisories/GHSA-xhgq-h98j-859v.md)
  `GHSA-xhgq-h98j-859v`, `CVE-2025-24397` · Maven `org.jenkins-ci.plugins:gitlab-plugin`: affected `<1.9.7`, fixed in `1.9.7` · CVSS 4.3 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Broken access control
- [Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL](https://agentprime.io/advisories/GHSA-qjw6-xvrm-5f2h.md)
  `GHSA-qjw6-xvrm-5f2h`, `CVE-2025-24398` · Maven `io.jenkins.plugins:atlassian-bitbucket-server-integration`: affected `>=2.1.0, <4.1.4`, fixed in `4.1.4` · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2025 · Tags: Cross-site request forgery (CSRF)
- [Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin](https://agentprime.io/advisories/GHSA-q9cm-88jx-3vfw.md)
  `GHSA-q9cm-88jx-3vfw`, `CVE-2025-24399` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<4.453.v4d7765c854f4`, fixed in `4.453.v4d7765c854f4` · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2025 · Tags: Broken access control, CWE-178
- [Cache confusion in Jenkins Eiffel Broadcaster Plugin](https://agentprime.io/advisories/GHSA-fpw7-8gjc-jwqj.md)
  `GHSA-fpw7-8gjc-jwqj`, `CVE-2025-24400` · Maven `com.axis.jenkins.plugins.eiffel:eiffel-broadcaster`: affected `>=2.8.0, <2.10.3`, fixed in `2.10.3` · CVSS 4.3 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Broken access control
- [Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak](https://agentprime.io/advisories/GHSA-m3hp-8546-5qmr.md)
  `GHSA-m3hp-8546-5qmr` · Maven `org.keycloak:keycloak-ldap-federation`: affected `<=26.1.0`, no fixed version yet · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 22 Jan 2025 · Tags: Authentication bypass
- [Apache Ranger UI vulnerable to Server Side Request Forgery](https://agentprime.io/advisories/GHSA-g9gf-g5jq-9h3v.md)
  `GHSA-g9gf-g5jq-9h3v`, `CVE-2024-45479` · Maven `org.apache.ranger:ranger`: affected `>=0.5.0, <2.5.0`, fixed in `2.5.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2025 · Tags: Server-side request forgery (SSRF), CWE-20
- [Apache Ranger has Stored Cross-site Scripting vulnerability in Edit Service Page](https://agentprime.io/advisories/GHSA-vrx2-mgr9-v67h.md)
  `GHSA-vrx2-mgr9-v67h`, `CVE-2024-45478` · Maven `org.apache.ranger:ranger`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 4.8 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Cross-site scripting (XSS), CWE-20
- [Elasticsearch allocation of resources without limits or throttling leads to crash](https://agentprime.io/advisories/GHSA-jgx4-7v3v-vwfm.md)
  `GHSA-jgx4-7v3v-vwfm`, `BIT-elasticsearch-2024-43709`, `CVE-2024-43709` · Maven `org.elasticsearch:elasticsearch`: affected `<7.17.21 || >=8.0.0, <8.13.3`, fixed in `7.17.21`, `8.13.3` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Denial of service
- [Apache CXF: Denial of Service vulnerability with temporary files](https://agentprime.io/advisories/GHSA-fh5r-crhr-qrrq.md)
  `GHSA-fh5r-crhr-qrrq`, `CVE-2025-23184` · Maven `org.apache.cxf:cxf-core`: affected `<3.5.10 || >=3.6.0, <3.6.5 || >=4.0.0, <4.0.6`, fixed in `3.5.10`, `3.6.5`, `4.0.6` · CVSS 5.9 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Denial of service
- [HAL Console has a Cross Site Scripting (XSS) vulnerability of user input](https://agentprime.io/advisories/GHSA-jhvj-f397-8w6q.md)
  `GHSA-jhvj-f397-8w6q`, `CVE-2025-23366` · Maven `org.jboss.hal:hal-console`: affected `<3.7.7.Final`, fixed in `3.7.7.Final` · CVSS 6.5 Medium · Not analysed yet · Published 16 Jan 2025 · Tags: Cross-site scripting (XSS)
- [Insecure Temporary File in RESTEasy](https://agentprime.io/advisories/GHSA-2c6g-pfx3-w7h8.md)
  `GHSA-2c6g-pfx3-w7h8`, `CVE-2023-0482` · Maven `org.jboss.resteasy:resteasy-core` and 1 more: affected `>=6.0.0.Beta1, <6.2.3.Final || >=5.0.0.Alpha1, <5.0.6.Final || >=4.0.0.Beta1, <4.7.8.Final || <3.15.5.Final`, fixed in `6.2.3.Final`, `5.0.6.Final`, `4.7.8.Final`, `3.15.5.Final` · CVSS 5.5 Medium · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-378
- [Duplicate Advisory: Wildfly HAL Console Cross-Site Scripting](https://agentprime.io/advisories/GHSA-5wjw-h8x5-v65m.md)
  `GHSA-5wjw-h8x5-v65m` · Maven `org.jboss.hal:hal-console`: affected `<=3.7.7.Final`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 14 Jan 2025 · Tags: Cross-site scripting (XSS)
- [Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability](https://agentprime.io/advisories/GHSA-8cvq-3jjp-ph9p.md)
  `GHSA-8cvq-3jjp-ph9p`, `CVE-2024-45627` · Maven `org.apache.linkis:linkis-metadata-query-service-jdbc`: affected `>=1.5.0, <1.7.0`, fixed in `1.7.0` · CVSS 5.9 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: Information disclosure
- [XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing](https://agentprime.io/advisories/GHSA-rmm7-r7wr-xpfg.md)
  `GHSA-rmm7-r7wr-xpfg`, `CVE-2025-23025` · Maven `org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui`: affected `>=13.9-rc-1, <15.10.12 || >=16.0.0-rc-1, <16.4.1 || >=16.5.0-rc-1, <16.6.0-rc-1`, fixed in `15.10.12`, `16.4.1`, `16.6.0-rc-1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: Broken access control
- [Denial of Service in Keycloak Server via Security Headers](https://agentprime.io/advisories/GHSA-w3g8-r9gw-qrh8.md)
  `GHSA-w3g8-r9gw-qrh8`, `CVE-2024-11734` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<26.0.8`, fixed in `26.0.8` · CVSS 6.5 Medium · Not analysed yet · Published 13 Jan 2025 · Tags: CWE-693
- [Keycloak allows unrestricted admin use of system and environment variables](https://agentprime.io/advisories/GHSA-f4v7-3mww-9gc2.md)
  `GHSA-f4v7-3mww-9gc2`, `CVE-2024-11736` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<26.0.8`, fixed in `26.0.8` · CVSS 4.9 Medium · Not analysed yet · Published 13 Jan 2025 · Tags: CWE-526
- [jte's HTML templates containing Javascript template strings are subject to XSS](https://agentprime.io/advisories/GHSA-vh22-6c6h-rm8q.md)
  `GHSA-vh22-6c6h-rm8q`, `CVE-2025-23026` · Maven `gg.jte:jte` and 1 more: affected `<3.1.16`, fixed in `3.1.16` · CVSS 6.1 Medium · Not analysed yet · Published 13 Jan 2025 · Tags: Cross-site scripting (XSS), CWE-150
- [Apache OpenMeetings vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-mjf9-4pcv-vfg7.md)
  `GHSA-mjf9-4pcv-vfg7`, `CVE-2024-54676` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=2.1.0, <8.0.0`, fixed in `8.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.69 · Not analysed yet · Published 8 Jan 2025 · Tags: Insecure deserialization
- [Narayana deadlock via multiple join requests sent to LRA Coordinator](https://agentprime.io/advisories/GHSA-qq9f-q439-2574.md)
  `GHSA-qq9f-q439-2574`, `CVE-2024-8447` · Maven `org.jboss.narayana.rts:lra-coordinator-jar`: affected `<7.1.0.Final`, fixed in `7.1.0.Final` · CVSS 5.9 Medium · Not analysed yet · Published 2 Jan 2025 · Tags: Denial of service
- [Apache NiFi: Missing Complete Authorization for Parameter and Service References](https://agentprime.io/advisories/GHSA-mpj7-7mg7-x95j.md)
  `GHSA-mpj7-7mg7-x95j`, `BIT-nifi-2024-56512`, `CVE-2024-56512` · Maven `org.apache.nifi:nifi-web-api`: affected `>=1.10.0, <2.1.0`, fixed in `2.1.0` · CVSS 2.1 Low · Not analysed yet · Published 28 Dec 2024 · Tags: Broken access control, CWE-638
- [Amazon Redshift JDBC Driver vulnerable to SQL Injection](https://agentprime.io/advisories/GHSA-8596-2jgr-ppj7.md)
  `GHSA-8596-2jgr-ppj7`, `CVE-2024-12744` · Maven `com.amazon.redshift:redshift-jdbc42`: affected `>=2.1.0.31, <2.1.0.32`, fixed in `2.1.0.32` · CVSS 8.6 High · Not analysed yet · Published 26 Dec 2024 · Tags: SQL injection
- [Apache MINA Deserialization RCE Vulnerability](https://agentprime.io/advisories/GHSA-76h9-2vwh-w278.md)
  `GHSA-76h9-2vwh-w278`, `CVE-2024-52046` · Maven `org.apache.mina:mina-core`: affected `>=2.2.0, <2.2.4 || >=2.1.0, <2.1.10 || >=2.0.0-M1, <2.0.27`, fixed in `2.2.4`, `2.1.10`, `2.0.27` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.25 · Not analysed yet · Published 25 Dec 2024 · Tags: Code injection, Insecure deserialization
- [Apache HugeGraph-Server: Fixed JWT Token (Secret)](https://agentprime.io/advisories/GHSA-f697-gm3h-xrf9.md)
  `GHSA-f697-gm3h-xrf9`, `CVE-2024-43441` · Maven `org.apache.hugegraph:hugegraph-server`: affected `>=1.0.0, <1.5.0`, fixed in `1.5.0` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.73 · Not analysed yet · Published 24 Dec 2024 · Tags: CWE-302
- [Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment](https://agentprime.io/advisories/GHSA-64gp-r758-8pfm.md)
  `GHSA-64gp-r758-8pfm` · Maven `org.jboss.hal:hal-console`: affected `<3.7.7.Final`, fixed in `3.7.7.Final` · CVSS 4.0, no score published · Not analysed yet · Published 23 Dec 2024 · Tags: Cross-site scripting (XSS), CWE-1395
- [Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails](https://agentprime.io/advisories/GHSA-77pm-w3hx-f8mj.md)
  `GHSA-77pm-w3hx-f8mj`, `CVE-2024-23945` · Maven `org.apache.hive:hive-service` and 2 more: affected `>=1.2.0, <4.0.0`, fixed in `4.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 23 Dec 2024 · Tags: Information disclosure
- [Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability](https://agentprime.io/advisories/GHSA-27hp-xhwr-wr2m.md)
  `GHSA-27hp-xhwr-wr2m`, `BIT-tomcat-2024-56337`, `CVE-2024-56337` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.2 || >=10.1.0-M1, <10.1.34 || >=9.0.0.M1, <9.0.98`, fixed in `11.0.2`, `10.1.34`, `9.0.98` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Dec 2024 · Tags: Race condition
- [Spring Framework Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-g5vr-rgqm-vf78.md)
  `GHSA-g5vr-rgqm-vf78`, `CVE-2024-38819` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=6.1.0, <6.1.14 || <=5.3.40 || >=6.0.0, <=6.0.24`, fixed in `6.1.14` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.56 · Not analysed yet · Published 19 Dec 2024 · Tags: Path traversal
- [QOS.CH logback-core Expression Language Injection vulnerability](https://agentprime.io/advisories/GHSA-pr98-23f8-jwxv.md)
  `GHSA-pr98-23f8-jwxv`, `CVE-2024-12798` · Maven `ch.qos.logback:logback-core`: affected `>=1.4.0, <1.5.13 || <1.3.15`, fixed in `1.5.13`, `1.3.15` · CVSS 5.9 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Code injection
- [QOS.CH logback-core Server-Side Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-6v67-2wr5-gvf4.md)
  `GHSA-6v67-2wr5-gvf4`, `CVE-2024-12801` · Maven `ch.qos.logback:logback-core`: affected `>=1.4.0, <1.5.13 || <1.3.15`, fixed in `1.5.13`, `1.3.15` · CVSS 2.4 Low · Not analysed yet · Published 19 Dec 2024 · Tags: Server-side request forgery (SSRF)
- [Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm](https://agentprime.io/advisories/GHSA-p7c9-8xx8-h74f.md)
  `GHSA-p7c9-8xx8-h74f`, `BIT-kafka-2024-56128`, `CVE-2024-56128` · Maven `org.apache.kafka:kafka_2.10` and 3 more: affected `>=0.10.2.0, <=0.10.2.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: Authentication bypass
- [Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page](https://agentprime.io/advisories/GHSA-px38-239g-x5mg.md)
  `GHSA-px38-239g-x5mg`, `CVE-2023-37940` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.0, <7.3.10.u30 || >=7.4, <7.4.13.u88`, fixed in `7.3.10.u30`, `7.4.13.u88` · CVSS 4.8 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: Keycloak vulnerable to Cleartext Transmission of Sensitive Information](https://agentprime.io/advisories/GHSA-6mpx-pmgp-ww49.md)
  `GHSA-6mpx-pmgp-ww49` · Maven `org.keycloak:keycloak-quarkus-server`: affected `>=25.0.0, <26.0.6`, fixed in `26.0.6` · CVSS 5.7 Medium · Withdrawn · Not analysed yet · Published 18 Dec 2024 · Tags: Weak cryptography or TLS
- [Databricks JDBC Driver Command Injection vulnerability](https://agentprime.io/advisories/GHSA-jxw2-jvxf-5vrp.md)
  `GHSA-jxw2-jvxf-5vrp`, `CVE-2024-49194` · Maven `com.databricks:databricks-jdbc`: affected `>=2.0, <2.6.40`, fixed in `2.6.40` · CVSS 7.3 High · Not analysed yet · Published 17 Dec 2024 · Tags: Command injection
- [Elasticsearch Incorrect Authorization vulnerability](https://agentprime.io/advisories/GHSA-5mpw-4546-2wcr.md)
  `GHSA-5mpw-4546-2wcr`, `BIT-elasticsearch-2024-12539`, `CVE-2024-12539` · Maven `org.elasticsearch:elasticsearch`: affected `>=8.16.0, <8.16.2`, fixed in `8.16.2` · CVSS 6.0 Medium · Not analysed yet · Published 17 Dec 2024 · Tags: Broken access control
- [Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-4hxr-28mv-q729.md)
  `GHSA-4hxr-28mv-q729`, `CVE-2024-11993` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.1, <7.4.13.u39`, fixed in `7.4.13.u39` · CVSS 4.6 Medium · Not analysed yet · Published 17 Dec 2024 · Tags: Cross-site scripting (XSS)
- [Apache Tomcat Uncontrolled Resource Consumption vulnerability](https://agentprime.io/advisories/GHSA-653p-vg55-5652.md)
  `GHSA-653p-vg55-5652`, `BIT-tomcat-2024-54677`, `CVE-2024-54677` · Maven `org.apache.tomcat:tomcat`: affected `>=11.0.0-M1, <11.0.2 || >=10.1.0-M1, <10.1.34 || >=9.0.0.M1, <9.0.98`, fixed in `11.0.2`, `10.1.34`, `9.0.98` · CVSS 5.3 Medium · Not analysed yet · Published 17 Dec 2024 · Tags: Denial of service
- [Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability](https://agentprime.io/advisories/GHSA-5j33-cvvr-w245.md)
  `GHSA-5j33-cvvr-w245`, `BIT-tomcat-2024-50379`, `CVE-2024-50379` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.2 || >=10.1.0-M1, <10.1.34 || >=9.0.0.M1, <9.0.98 || >=8.5.0, <=8.5.100`, fixed in `11.0.2`, `10.1.34`, `9.0.98` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.32 · Not analysed yet · Published 17 Dec 2024 · Tags: Race condition
- [Welcome and About GeoServer pages communicate version and revision information](https://agentprime.io/advisories/GHSA-6pfc-w86r-54q6.md)
  `GHSA-6pfc-w86r-54q6`, `CVE-2024-35230` · Maven `org.geoserver.web:gs-web-app` and 1 more: affected `>=2.0.0, <2.25.1`, fixed in `2.25.1` · CVSS 5.3 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Information disclosure
- [Ucum-java has an XXE vulnerability in XML parsing](https://agentprime.io/advisories/GHSA-w9j7-phm3-f97j.md)
  `GHSA-w9j7-phm3-f97j`, `CVE-2024-55887` · Maven `org.fhir:ucum`: affected `<1.0.9`, fixed in `1.0.9` · CVSS 8.6 High · Not analysed yet · Published 13 Dec 2024 · Tags: XML external entities (XXE)
- [XWiki allows remote code execution through the extension sheet](https://agentprime.io/advisories/GHSA-j2pq-22jj-4pm5.md)
  `GHSA-j2pq-22jj-4pm5`, `CVE-2024-55662` · Maven `org.xwiki.platform:xwiki-platform-repository-server-ui`: affected `>=3.3-milestone-1, <15.10.9 || >=16.0.0-rc-1, <16.3.0`, fixed in `15.10.9`, `16.3.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2024 · Tags: Code injection, Broken access control
- [XWiki Platform has an SQL injection in getdocuments.vm with sort parameter](https://agentprime.io/advisories/GHSA-wh34-m772-5398.md)
  `GHSA-wh34-m772-5398`, `CVE-2024-55663` · Maven `org.xwiki.platform:xwiki-platform-distribution-war`: affected `>=6.3-milestone-2, <13.10.5 || >=14.0-rc-1, <14.3-rc-1`, fixed in `13.10.5`, `14.3-rc-1` · CVSS 8.6 High · Not analysed yet · Published 12 Dec 2024 · Tags: CWE-116
- [http4k has a potential XXE (XML External Entity Injection) vulnerability](https://agentprime.io/advisories/GHSA-7mj5-hjjj-8rgw.md)
  `GHSA-7mj5-hjjj-8rgw`, `CVE-2024-55875` · Maven `org.http4k:http4k-format-xml`: affected `<6.50.0.0`, fixed in `6.50.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2024 · Tags: Information disclosure, XML external entities (XXE), Server-side request forgery (SSRF)
- [XWiki's scheduler in subwiki allows scheduling operations for any main wiki user](https://agentprime.io/advisories/GHSA-cwq6-mjmx-47p6.md)
  `GHSA-cwq6-mjmx-47p6`, `CVE-2024-55876` · Maven `org.xwiki.platform:xwiki-platform-scheduler-ui`: affected `>=1.2-milestone-2, <15.10.9 || >=16.0.0-rc-1, <16.3.0`, fixed in `15.10.9`, `16.3.0` · CVSS 5.4 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: Broken access control
- [XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList](https://agentprime.io/advisories/GHSA-2r87-74cx-2p7c.md)
  `GHSA-2r87-74cx-2p7c`, `CVE-2024-55877` · Maven `org.xwiki.platform:xwiki-platform-help-ui`: affected `>=9.7-rc-1, <15.10.11 || >=16.0.0-rc-1, <16.4.1 || >=16.5.0-rc-1, <16.5.0`, fixed in `15.10.11`, `16.4.1`, `16.5.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2024 · Tags: Code injection
- [XWiki allows RCE from script right in configurable sections](https://agentprime.io/advisories/GHSA-r279-47wg-chpr.md)
  `GHSA-r279-47wg-chpr`, `CVE-2024-55879` · Maven `org.xwiki.platform:xwiki-platform-administration-ui`: affected `>=2.3, <15.10.9 || >=16.0.0-rc-1, <16.3.0`, fixed in `15.10.9`, `16.3.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2024 · Tags: Broken access control
- [Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse](https://agentprime.io/advisories/GHSA-22c5-cpvr-cfvq.md)
  `GHSA-22c5-cpvr-cfvq`, `CVE-2024-4109` · Maven `io.undertow:undertow-core`: affected `<=2.3.18.Final`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 12 Dec 2024 · Tags: Information disclosure
- [io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling](https://agentprime.io/advisories/GHSA-cxrx-q234-m22m.md)
  `GHSA-cxrx-q234-m22m`, `CVE-2024-12397` · Maven `io.quarkus.http:quarkus-http-core`: affected `<5.3.4`, fixed in `5.3.4` · CVSS 7.4 High · Not analysed yet · Published 12 Dec 2024 · Tags: HTTP request smuggling
- [Apache Struts file upload logic is flawed](https://agentprime.io/advisories/GHSA-43mq-6xmg-29vm.md)
  `GHSA-43mq-6xmg-29vm`, `CVE-2024-53677` · Maven `org.apache.struts:struts2-core`: affected `<6.4.0`, fixed in `6.4.0` · CVSS 9.5 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.72 · Not analysed yet · Published 11 Dec 2024 · Tags: Path traversal, Unrestricted file upload, Broken access control
- [Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack](https://agentprime.io/advisories/GHSA-4v5x-9m47-cqr2.md)
  `GHSA-4v5x-9m47-cqr2` · Maven `org.wildfly:wildfly-elytron-oidc-client-subsystem`: affected `<=34.0.1.Final`, no fixed version yet · CVSS 4.2 Medium · Withdrawn · Not analysed yet · Published 9 Dec 2024 · Tags: CWE-345
- [sigstore-java has a vulnerability with bundle verification](https://agentprime.io/advisories/GHSA-jp26-88mw-89qr.md)
  `GHSA-jp26-88mw-89qr`, `CVE-2024-54140` · Maven `dev.sigstore:sigstore-java`: affected `<1.2.0`, fixed in `1.2.0` · CVSS 2.1 Low · Not analysed yet · Published 5 Dec 2024 · Tags: CWE-20
- [Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore](https://agentprime.io/advisories/GHSA-6hqr-c69m-r76q.md)
  `GHSA-6hqr-c69m-r76q`, `CVE-2022-41137` · Maven `org.apache.hive:hive-exec`: affected `>=4.0.0-alpha-1, <4.0.0-alpha-2`, fixed in `4.0.0-alpha-2` · CVSS 8.3 High · Not analysed yet · Published 5 Dec 2024 · Tags: Insecure deserialization
- [Spring LDAP data exposure vulnerability](https://agentprime.io/advisories/GHSA-mqvr-2rp8-j7h4.md)
  `GHSA-mqvr-2rp8-j7h4`, `CVE-2024-38829` · Maven `org.springframework.ldap:spring-ldap-core`: affected `>=3.0.0, <3.2.8 || <2.4.4`, fixed in `3.2.8`, `2.4.4` · CVSS 3.7 Low · Not analysed yet · Published 4 Dec 2024 · Tags: CWE-178
- [Apache Ozone: Improper authentication when generating S3 secrets](https://agentprime.io/advisories/GHSA-rcq8-9q3j-98mw.md)
  `GHSA-rcq8-9q3j-98mw`, `CVE-2024-45106` · Maven `org.apache.ozone:ozone`: affected `>=1.4.0, <1.4.1`, fixed in `1.4.1` · CVSS 8.1 High · Not analysed yet · Published 3 Dec 2024 · Tags: Authentication bypass, Broken access control
- [AsyncHttpClient (AHC) library's \`CookieStore\` replaces explicitly defined \`Cookie\`s](https://agentprime.io/advisories/GHSA-mfj5-cf8g-g2fv.md)
  `GHSA-mfj5-cf8g-g2fv`, `CVE-2024-53990` · Maven `org.asynchttpclient:async-http-client`: affected `>=2.1.0, <2.12.4 || >=3.0.0.Beta1, <3.0.1`, fixed in `2.12.4`, `3.0.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Dec 2024 · Tags: Authentication bypass
- [Withdrawn Advisory: Netty vulnerability included in redis lettuce](https://agentprime.io/advisories/GHSA-q4h9-7rxj-7gx2.md)
  `GHSA-q4h9-7rxj-7gx2` · Maven `io.lettuce:lettuce-core`: affected `<6.5.1.RELEASE`, fixed in `6.5.1.RELEASE` · CVSS 5.5 Medium · Withdrawn · Not analysed yet · Published 2 Dec 2024 · Tags: Denial of service
- [veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability](https://agentprime.io/advisories/GHSA-4cx5-89vm-833x.md)
  `GHSA-4cx5-89vm-833x`, `CVE-2024-52800` · Maven `org.verapdf:core` and 8 more: affected `<1.26.2`, fixed in `1.26.2` · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2024 · Tags: XML external entities (XXE)
- [Spring Framework has Authorization Bypass for Case Sensitive Comparisons](https://agentprime.io/advisories/GHSA-q3v6-hm2v-pw99.md)
  `GHSA-q3v6-hm2v-pw99`, `CVE-2024-38827` · Maven `org.springframework.security:spring-security-core`: affected `<5.7.14 || >=5.8.0, <5.8.16 || >=6.0.0, <6.0.14 || >=6.1.0, <6.1.12 || >=6.2.0, <6.2.8 || >=6.3.0, <6.3.5`, fixed in `5.7.14`, `5.8.16`, `6.0.14`, `6.1.12`, `6.2.8`, `6.3.5` · CVSS 4.8 Medium · Not analysed yet · Published 2 Dec 2024 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI0LTEyLTAyVDE1OjMxOjQxLjAwMDAwMFoiLCJHSFNBLXEzdjYtaG0ydi1wdzk5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTAxLTIyVDIxOjMwOjU3LjAwMDAwMFoiLCJHSFNBLTc4OG0tMjdnNC1jZjg2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTAxLTIyVDIxOjMwOjU3LjAwMDAwMFoiLCJHSFNBLTc4OG0tMjdnNC1jZjg2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.