# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations](https://agentprime.io/advisories/GHSA-6qvp-39mm-95v8.md) `GHSA-6qvp-39mm-95v8`, `CVE-2025-27603` · Maven `com.xwiki.confluencepro:application-confluence-migrator-pro-ui`: affected `>=1.0, <1.2.0`, fixed in `1.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Mar 2025 · Tags: Code injection - [Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission](https://agentprime.io/advisories/GHSA-rfh6-9r2q-98vf.md) `GHSA-rfh6-9r2q-98vf`, `BIT-jenkins-2025-27623`, `CVE-2025-27623` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.492.2 || >=2.493, <2.500`, fixed in `2.492.2`, `2.500` · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Information disclosure - [Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission](https://agentprime.io/advisories/GHSA-p34j-r3ch-c985.md) `GHSA-p34j-r3ch-c985`, `BIT-jenkins-2025-27622`, `CVE-2025-27622` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.493, <2.500 || <2.492.2`, fixed in `2.500`, `2.492.2` · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Information disclosure - [Jenkins Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-8hmv-92wm-39ch.md) `GHSA-8hmv-92wm-39ch`, `BIT-jenkins-2025-27625`, `CVE-2025-27625` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.492.2 || >=2.493, <2.500`, fixed in `2.492.2`, `2.500` · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Open redirect - [Jenkins cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-7g95-jmg9-h524.md) `GHSA-7g95-jmg9-h524`, `BIT-jenkins-2025-27624`, `CVE-2025-27624` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.493, <2.500 || <2.492.2`, fixed in `2.500`, `2.492.2` · CVSS 5.4 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Cross-site request forgery (CSRF) - [Emissary May Use a Broken or Risky Cryptographic Algorithm](https://agentprime.io/advisories/GHSA-hw43-fcmm-3m5g.md) `GHSA-hw43-fcmm-3m5g`, `CVE-2025-27508` · Maven `gov.nsa.emissary:emissary`: affected `<8.24.0`, fixed in `8.24.0` · CVSS 7.5 High · Not analysed yet · Published 5 Mar 2025 · Tags: Weak cryptography or TLS - [OpenDJ Denial of Service (DoS) using alias loop](https://agentprime.io/advisories/GHSA-93qr-h8pr-4593.md) `GHSA-93qr-h8pr-4593`, `CVE-2025-27497` · Maven `org.openidentityplatform.opendj:opendj-server-legacy`: affected `<4.9.3`, fixed in `4.9.3` · CVSS 8.7 High · Not analysed yet · Published 5 Mar 2025 · Tags: Denial of service - [Lucee RCE/XXE Vulnerability](https://agentprime.io/advisories/GHSA-vwjx-mmwm-pwrf.md) `GHSA-vwjx-mmwm-pwrf`, `CVE-2023-38693` · Maven `org.lucee:lucee`: affected `>=5.3.10.79-RC, <5.3.12.1 || >=5.4.0.65-RC, <5.4.3.2 || <=5.3.7.59 || >=5.3.8.132-RC, <5.3.8.236 || >=5.3.9.113, <5.3.9.173`, fixed in `5.3.12.1`, `5.4.3.2`, `5.3.8.236`, `5.3.9.173` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: XML external entities (XXE) - [Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI](https://agentprime.io/advisories/GHSA-3jxr-23ph-c89g.md) `GHSA-3jxr-23ph-c89g` · Maven `org.wildfly.core:wildfly-elytron-integration`: affected `<=27.0.0.Final`, no fixed version yet · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 4 Mar 2025 · Tags: Authentication bypass - [Apache Ranger Improper Neutralization of Formula Elements vulnerability](https://agentprime.io/advisories/GHSA-2h4w-p9fh-9rmv.md) `GHSA-2h4w-p9fh-9rmv`, `CVE-2024-55532` · Maven `org.apache.ranger:security-admin-web`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2025 · Tags: Other injection - [Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via \`include\` macro](https://agentprime.io/advisories/GHSA-p75g-cxfj-7wrx.md) `GHSA-p75g-cxfj-7wrx`, `CVE-2025-1686` · Maven `io.pebbletemplates:pebble`: affected `<=3.2.3`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 28 Feb 2025 · Tags: Path traversal - [WSO2 incorrect authorization vulnerability](https://agentprime.io/advisories/GHSA-6qjp-wm6g-m32r.md) `GHSA-6qjp-wm6g-m32r`, `CVE-2024-2321` · Maven `org.wso2.am:am-parent` and 1 more: affected `>=4.2.0-beta, <=4.2.0 || >=4.1.0-alpha, <=4.1.0 || >=4.0.0-beta, <=4.0.0`, no fixed version yet · CVSS 5.6 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: Broken access control - [io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout](https://agentprime.io/advisories/GHSA-4fwr-mh5q-hchh.md) `GHSA-4fwr-mh5q-hchh`, `CVE-2025-1634` · Maven `io.quarkus:quarkus-resteasy`: affected `>=3.16.0.CR1, <3.19.1 || >=3.9.0.CR1, <3.15.3.1 || <3.8.6.1`, fixed in `3.19.1`, `3.15.3.1`, `3.8.6.1` · CVSS 7.5 High · Not analysed yet · Published 26 Feb 2025 · Tags: Denial of service - [Solon Path Traversal](https://agentprime.io/advisories/GHSA-x8q6-cchr-p7m6.md) `GHSA-x8q6-cchr-p7m6`, `CVE-2025-1584` · Maven `org.noear:solon-web-staticfiles`: affected `<3.0.9`, fixed in `3.0.9` · CVSS 5.3 Medium · Not analysed yet · Published 23 Feb 2025 · Tags: Path traversal - [XWiki Platform allows remote code execution as guest via SolrSearchMacros request](https://agentprime.io/advisories/GHSA-rr6p-3pfg-562j.md) `GHSA-rr6p-3pfg-562j`, `CVE-2025-24893` · Maven `org.xwiki.platform:xwiki-platform-search-solr-ui`: affected `>=5.3-milestone-2, <15.10.11 || >=16.0.0-rc-1, <16.4.1`, fixed in `15.10.11`, `16.4.1` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 20 Feb 2025 · Tags: Code injection - [Kwik hash collision vulnerability](https://agentprime.io/advisories/GHSA-9f57-9rhg-4hvm.md) `GHSA-9f57-9rhg-4hvm`, `CVE-2025-23020` · Maven `tech.kwik:kwik`: affected `<0.10.1`, fixed in `0.10.1` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2025 · Tags: Denial of service - [Keycloak allows cross-site scripting (XSS)](https://agentprime.io/advisories/GHSA-q4xq-445g-g6ch.md) `GHSA-q4xq-445g-g6ch`, `CVE-2024-4028` · Maven `org.keycloak:keycloak-core`: affected `<=26.1.2`, no fixed version yet · CVSS 3.8 Low · Not analysed yet · Published 18 Feb 2025 · Tags: Cross-site scripting (XSS), CWE-20 - [Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User](https://agentprime.io/advisories/GHSA-rq4w-cjrr-h8w8.md) `GHSA-rq4w-cjrr-h8w8` · Maven `org.keycloak:keycloak-services`: affected `<26.1.2`, fixed in `26.1.2` · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 17 Feb 2025 · Tags: Broken access control - [Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution](https://agentprime.io/advisories/GHSA-ffvr-gmp3-xx43.md) `GHSA-ffvr-gmp3-xx43`, `CVE-2024-56180` · Maven `org.apache.eventmesh:eventmesh-meta-raft`: affected `>=1.10.1, <1.11.0`, fixed in `1.11.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Feb 2025 · Tags: Insecure deserialization - [Apache Ignite: Possible RCE when deserializing incoming messages by the server node](https://agentprime.io/advisories/GHSA-8355-xj3p-hv6q.md) `GHSA-8355-xj3p-hv6q`, `CVE-2024-52577` · Maven `org.apache.ignite:ignite-core`: affected `>=2.6.0, <2.17.0`, fixed in `2.17.0` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Feb 2025 · Tags: Insecure deserialization - [Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC](https://agentprime.io/advisories/GHSA-mrqp-q7vx-v2cx.md) `GHSA-mrqp-q7vx-v2cx`, `CVE-2025-26511` · Maven `com.instaclustr:cassandra-lucene-index-plugin`: affected `>=4.0-rc1-1.0.0, <4.0.17-1.0.0 || >=4.1.0-1.0.0, <4.1.8-1.0.1`, fixed in `4.0.17-1.0.0`, `4.1.8-1.0.1` · CVSS 8.8 High · Not analysed yet · Published 13 Feb 2025 · Tags: Authentication bypass, Broken access control - [Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance](https://agentprime.io/advisories/GHSA-phg3-gv66-q38x.md) `GHSA-phg3-gv66-q38x`, `CVE-2025-1247` · Maven `io.quarkus:quarkus-rest` and 1 more: affected `>=3.16.0.CR1, <3.18.2 || >=3.9.0.CR1, <3.15.3.1 || <3.8.6.1`, fixed in `3.18.2`, `3.15.3.1`, `3.8.6.1` · CVSS 8.3 High · Not analysed yet · Published 13 Feb 2025 · Tags: CWE-488 - [Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user](https://agentprime.io/advisories/GHSA-x3v6-f5fr-4wwv.md) `GHSA-x3v6-f5fr-4wwv`, `CVE-2024-46910` · Maven `org.apache.atlas:apache-atlas`: affected `>=2.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 7.1 High · Not analysed yet · Published 13 Feb 2025 · Tags: Cross-site scripting (XSS) - [GeoNetwork search end-point information disclosure in response headers](https://agentprime.io/advisories/GHSA-52rf-25hq-5m33.md) `GHSA-52rf-25hq-5m33`, `CVE-2024-32037` · Maven `org.geonetwork-opensource:gn-services`: affected `>=4.4.0, <4.4.5 || <4.2.10`, fixed in `4.4.5`, `4.2.10` · CVSS 0.0 None · Not analysed yet · Published 11 Feb 2025 · Tags: Information disclosure - [Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log](https://agentprime.io/advisories/GHSA-v3vc-6qcv-4vrx.md) `GHSA-v3vc-6qcv-4vrx`, `CVE-2024-52067` · Maven `org.apache.nifi:nifi-framework-core`: affected `>=1.16.0, <1.28.1 || >=2.0.0-M1, <2.0.0`, fixed in `1.28.1`, `2.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: Information disclosure - [Denial of Service attack on windows app using Netty](https://agentprime.io/advisories/GHSA-389x-839f-4rhx.md) `GHSA-389x-839f-4rhx`, `CVE-2025-25193` · Maven `io.netty:netty-common`: affected `<4.1.118.Final`, fixed in `4.1.118.Final` · CVSS 5.5 Medium · Not analysed yet · Published 10 Feb 2025 · Tags: Denial of service - [SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine](https://agentprime.io/advisories/GHSA-4g8c-wm8x-jfhw.md) `GHSA-4g8c-wm8x-jfhw`, `CVE-2025-24970` · Maven `io.netty:netty-handler`: affected `>=4.1.91.Final, <4.1.118.Final`, fixed in `4.1.118.Final` · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2025 · Tags: CWE-20 - [Apache Felix Webconsole: XSS in services console](https://agentprime.io/advisories/GHSA-4c37-7m5h-c8m9.md) `GHSA-4c37-7m5h-c8m9`, `CVE-2025-25247` · Maven `org.apache.felix:org.apache.felix.webconsole`: affected `>=4.0.0, <4.9.10 || >=5.0.0, <5.0.10`, fixed in `4.9.10`, `5.0.10` · CVSS 6.1 Medium · Not analysed yet · Published 10 Feb 2025 · Tags: Cross-site scripting (XSS) - [SQL injection in JeecgBoot](https://agentprime.io/advisories/GHSA-wfpm-qchc-6cf9.md) `GHSA-wfpm-qchc-6cf9`, `CVE-2024-57606` · Maven `org.jeecgframework.boot:jeecg-boot-common`: affected `<3.7.3`, fixed in `3.7.3` · CVSS 7.5 High · Not analysed yet · Published 8 Feb 2025 · Tags: SQL injection, Information disclosure - [Apache James vulnerable to denial of service through JMAP HTML to text conversion](https://agentprime.io/advisories/GHSA-57m2-h3fw-rxhw.md) `GHSA-57m2-h3fw-rxhw`, `CVE-2024-45626` · Maven `org.apache.james:james-server-jmap-draft`: affected `>=3.8.0, <3.8.2 || <3.7.6`, fixed in `3.8.2`, `3.7.6` · CVSS 6.5 Medium · Not analysed yet · Published 6 Feb 2025 · Tags: Denial of service - [Apache James vulnerable to denial of service through the use of IMAP literals](https://agentprime.io/advisories/GHSA-56jp-w6vw-j3jw.md) `GHSA-56jp-w6vw-j3jw`, `CVE-2024-37358` · Maven `org.apache.james.protocols:protocols-imap`: affected `<3.7.6 || >=3.8.0, <3.8.2`, fixed in `3.7.6`, `3.8.2` · CVSS 8.6 High · Not analysed yet · Published 6 Feb 2025 · Tags: Denial of service, CWE-20 - [Netplex Json-smart Uncontrolled Recursion vulnerability](https://agentprime.io/advisories/GHSA-pq2g-wx69-c263.md) `GHSA-pq2g-wx69-c263`, `CVE-2024-57699` · Maven `net.minidev:json-smart`: affected `>=2.5.0, <2.5.2`, fixed in `2.5.2` · CVSS 7.5 High · Not analysed yet · Published 6 Feb 2025 · Tags: Denial of service - [Keycloak on Quarkus CLI option for encrypted JGroups ignored](https://agentprime.io/advisories/GHSA-g6qq-c9f9-2772.md) `GHSA-g6qq-c9f9-2772`, `CVE-2024-10973` · Maven `org.keycloak:keycloak-quarkus-server`: affected `>=25.0.0, <26.0.6`, fixed in `26.0.6` · CVSS 5.7 Medium · Not analysed yet · Published 5 Feb 2025 · Tags: Weak cryptography or TLS - [GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions](https://agentprime.io/advisories/GHSA-w3pj-wh35-fq8w.md) `GHSA-w3pj-wh35-fq8w`, `CVE-2024-36404` · Maven `org.geotools:gt-app-schema` and 2 more: affected `>=30.0, <30.4 || >=31.0, <31.2 || >=29.0, <29.6 || <28.6`, fixed in `30.4`, `31.2`, `29.6`, `28.6` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.76 · Not analysed yet · Published 5 Feb 2025 · Tags: Code injection - [Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions](https://agentprime.io/advisories/GHSA-wmcc-9vch-jmx4.md) `GHSA-wmcc-9vch-jmx4`, `BIT-cassandra-2025-23015`, `CVE-2025-23015` · Maven `org.apache.cassandra:cassandra-all`: affected `>=5.0-alpha1, <5.0.3 || >=4.1-alpha1, <4.1.8 || >=4.0-alpha1, <4.0.16 || >=3.1, <3.11.18 || <3.0.31`, fixed in `5.0.3`, `4.1.8`, `4.0.16`, `3.11.18`, `3.0.31` · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2025 · Tags: Privilege escalation - [Apache Cassandra: unrestricted deserialization of JMX authentication credentials](https://agentprime.io/advisories/GHSA-rgfx-7p65-3ff4.md) `GHSA-rgfx-7p65-3ff4`, `BIT-cassandra-2024-27137`, `CVE-2024-27137` · Maven `org.apache.cassandra:cassandra-all`: affected `>=5.0-beta1, <5.0.3 || >=4.1.0, <4.1.8 || >=4.0.2, <4.0.15`, fixed in `5.0.3`, `4.1.8`, `4.0.15` · CVSS 5.9 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Authentication bypass, Information disclosure - [Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions](https://agentprime.io/advisories/GHSA-3cjf-fwcq-xh22.md) `GHSA-3cjf-fwcq-xh22`, `BIT-cassandra-2025-24860`, `CVE-2025-24860` · Maven `org.apache.cassandra:cassandra-all`: affected `>=4.0-alpha1, <4.0.16 || >=4.1-alpha1, <4.1.8 || >=5.0-alpha1, <5.0.3`, fixed in `4.0.16`, `4.1.8`, `5.0.3` · CVSS 5.4 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Broken access control - [Jenkins Zoom Plugin is Missing Password Field Masking](https://agentprime.io/advisories/GHSA-4352-jxwg-88rm.md) `GHSA-4352-jxwg-88rm`, `CVE-2025-0148` · Maven `io.jenkins.plugins:zoom`: affected `<1.6`, fixed in `1.6` · CVSS 2.6 Low · Not analysed yet · Published 4 Feb 2025 · Tags: CWE-549 - [S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends](https://agentprime.io/advisories/GHSA-2ccp-vqmv-4r4x.md) `GHSA-2ccp-vqmv-4r4x`, `CVE-2025-24961` · Maven `org.gaul:s3proxy`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 6.0 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: Path traversal - [WildFly improper RBAC permission](https://agentprime.io/advisories/GHSA-qr6x-62gq-4ccp.md) `GHSA-qr6x-62gq-4ccp`, `BIT-wildfly-2025-23367`, `CVE-2025-23367` · Maven `org.wildfly.core:wildfly-server`: affected `<27.0.1.Final || >=28.0.0.Beta1, <28.0.0.Beta2`, fixed in `27.0.1.Final`, `28.0.0.Beta2` · CVSS 6.5 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: Broken access control - [PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext](https://agentprime.io/advisories/GHSA-88m4-h43f-wx84.md) `GHSA-88m4-h43f-wx84`, `CVE-2025-23215` · Maven `net.sourceforge.pmd:pmd-core` and 2 more: affected `>=6.21.0, <7.10.0`, fixed in `7.10.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jan 2025 · Tags: Information disclosure, CWE-540 - [Jenkins Zoom Plugin Stores Sensitive Information in Cleartext](https://agentprime.io/advisories/GHSA-jx45-xp6q-cwjc.md) `GHSA-jx45-xp6q-cwjc`, `CVE-2025-0142` · Maven `io.jenkins.plugins:zoom`: affected `<1.4`, fixed in `1.4` · CVSS 4.3 Medium · Not analysed yet · Published 30 Jan 2025 · Tags: Information disclosure - [General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches](https://agentprime.io/advisories/GHSA-vpxm-cr3r-pjp9.md) `GHSA-vpxm-cr3r-pjp9` · Maven `org.openmrs.module:addresshierarchy` and 5 more: affected `<2.19.0`, fixed in `2.19.0` · No CVSS score · Not analysed yet · Published 30 Jan 2025 · Tags: Information disclosure, Broken access control, Open redirect, CWE-614 - [Duplicate Advisory: Wildfly Server Role Based Access Control (RBAC) provider has Improper Access Control](https://agentprime.io/advisories/GHSA-fcrw-mphx-7cxf.md) `GHSA-fcrw-mphx-7cxf` · Maven `org.wildfly:wildfly-server`: affected `<=27.0.0.Final`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 30 Jan 2025 · Tags: Broken access control - [Deep Java Library path traversal issue](https://agentprime.io/advisories/GHSA-jcrp-x7w3-ffmg.md) `GHSA-jcrp-x7w3-ffmg`, `CVE-2025-0851` · Maven `ai.djl:api`: affected `<0.31.1`, fixed in `0.31.1` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 29 Jan 2025 · Tags: Path traversal - [Snowflake JDBC uses insecure temporary credential cache file permissions](https://agentprime.io/advisories/GHSA-33g6-495w-v8j2.md) `GHSA-33g6-495w-v8j2`, `CVE-2025-24790` · Maven `net.snowflake:snowflake-jdbc`: affected `>=3.6.8, <3.22.0`, fixed in `3.22.0` · CVSS 4.4 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: Broken access control - [Snowflake JDBC allows an untrusted search path on Windows](https://agentprime.io/advisories/GHSA-7hpq-3g6w-pvhf.md) `GHSA-7hpq-3g6w-pvhf`, `CVE-2025-24789` · Maven `net.snowflake:snowflake-jdbc`: affected `>=3.2.3, <3.22.0`, fixed in `3.22.0` · CVSS 7.8 High · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-426 - [RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring](https://agentprime.io/advisories/GHSA-v664-qgx9-wf79.md) `GHSA-v664-qgx9-wf79`, `CVE-2024-57436` · Maven `com.ruoyi:ruoyi`: affected `<=4.8.0`, no fixed version yet · CVSS 7.2 High · Not analysed yet · Published 29 Jan 2025 · Tags: Information disclosure - [RuoYi vulnerable to Denial of Service by attackers with admin privileges](https://agentprime.io/advisories/GHSA-qq5h-rjj9-q9qg.md) `GHSA-qq5h-rjj9-q9qg`, `CVE-2024-57439` · Maven `com.ruoyi:ruoyi`: affected `<=4.8.0`, no fixed version yet · CVSS 4.9 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-281 - [RuoYi has insecure permissions](https://agentprime.io/advisories/GHSA-h5jh-rp76-q242.md) `GHSA-h5jh-rp76-q242`, `CVE-2024-57438` · Maven `com.ruoyi:ruoyi`: affected `<=4.8.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: Broken access control - [Apache Hive Incorrectly Assigns Permissions for a Critical Resource](https://agentprime.io/advisories/GHSA-c476-j253-5rgq.md) `GHSA-c476-j253-5rgq`, `CVE-2024-29869` · Maven `org.apache.hive:hive-exec`: affected `<4.0.1`, fixed in `4.0.1` · CVSS 5.5 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: Broken access control - [Apache Hive vulnerable to Observable Timing Discrepancy and Authentication Bypass by Spoofing](https://agentprime.io/advisories/GHSA-p953-3j66-hg45.md) `GHSA-p953-3j66-hg45`, `CVE-2024-23953` · Maven `org.apache.hive:hive-llap-common`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Jan 2025 · Tags: Authentication bypass, CWE-208 - [Infinispan vulnerable to Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/GHSA-269m-c36j-r834.md) `GHSA-269m-c36j-r834`, `CVE-2025-0736` · Maven `org.infinispan:infinispan-parent`: affected `<=15.1.4.Final`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 28 Jan 2025 · Tags: Information disclosure - [Apache Cocoon vulnerable to Incorrect Usage of Seeds in Pseudo-Random Number Generator](https://agentprime.io/advisories/GHSA-pff9-53m5-qr56.md) `GHSA-pff9-53m5-qr56`, `CVE-2025-24783` · Maven `org.apache.cocoon:cocoon-forms-impl` and 1 more: affected `<=2.3.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-335 - [Apache Solr vulnerable to Execution with Unnecessary Privileges](https://agentprime.io/advisories/GHSA-68r2-fwcg-qpm8.md) `GHSA-68r2-fwcg-qpm8`, `BIT-solr-2025-24814`, `CVE-2025-24814` · Maven `org.apache.solr:solr-core`: affected `<9.8.0`, fixed in `9.8.0` · CVSS 5.4 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: Privilege escalation - [Apache Solr Relative Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-4p5m-gvpf-f3x5.md) `GHSA-4p5m-gvpf-f3x5`, `BIT-solr-2024-52012`, `CVE-2024-52012` · Maven `org.apache.solr:solr-core`: affected `>=6.6, <9.8.0`, fixed in `9.8.0` · CVSS 5.4 Medium · EPSS 0.47 · Not analysed yet · Published 27 Jan 2025 · Tags: Path traversal - [HL7 FHIR IG Publisher potentially exposes GitHub repo user and credential information](https://agentprime.io/advisories/GHSA-6729-95v3-pjc2.md) `GHSA-6729-95v3-pjc2`, `CVE-2025-24363` · Maven `org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli` and 1 more: affected `<1.8.9`, fixed in `1.8.9` · CVSS 4.2 Medium · Not analysed yet · Published 24 Jan 2025 · Tags: Information disclosure - [XXE vulnerability in XSLT parsing in \`org.hl7.fhir.publisher\`](https://agentprime.io/advisories/GHSA-8c3x-hq82-gjcm.md) `GHSA-8c3x-hq82-gjcm`, `CVE-2024-52807` · Maven `org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli` and 1 more: affected `<1.7.4`, fixed in `1.7.4` · CVSS 8.6 High · Not analysed yet · Published 24 Jan 2025 · Tags: XML external entities (XXE) - [Apache Wicket: An attacker can intentionally trigger a memory leak](https://agentprime.io/advisories/GHSA-9cxr-76pm-j3wf.md) `GHSA-9cxr-76pm-j3wf`, `CVE-2024-53299` · Maven `org.apache.wicket:wicket-core`: affected `>=7.0.0, <8.17.0 || >=10.0.0, <10.3.0 || >=9.0.0-M1, <9.19.0`, fixed in `8.17.0`, `10.3.0`, `9.19.0` · CVSS 6.5 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: Denial of service - [Cross site scripting in Silverpeas Core](https://agentprime.io/advisories/GHSA-788m-27g4-cf86.md) `GHSA-788m-27g4-cf86`, `CVE-2024-56923` · Maven `org.silverpeas.core:silverpeas-core`: affected `>=6.3.1, <6.4.2`, fixed in `6.4.2` · CVSS 5.4 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .