# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Jenkins Gogs Plugin uses non-constant time webhook token comparison](https://agentprime.io/advisories/GHSA-885r-hhpr-cc9p.md)
  `GHSA-885r-hhpr-cc9p`, `CVE-2023-46657` · Maven `org.jenkins-ci.plugins:gogs-webhook`: affected `<=1.0.15`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison](https://agentprime.io/advisories/GHSA-8859-v9jp-cphf.md)
  `GHSA-8859-v9jp-cphf`, `CVE-2023-46656` · Maven `igalg.jenkins.plugins:multibranch-scan-webhook-trigger`: affected `<=1.0.9`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [Non-constant time webhook token hash comparison in Jenkins Zanata Plugin](https://agentprime.io/advisories/GHSA-86j9-25m2-9w97.md)
  `GHSA-86j9-25m2-9w97`, `CVE-2023-46660` · Maven `org.jenkins-ci.plugins:zanata`: affected `<=0.6`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [Jenkins Warnings Plugin exposures system-scoped credentials](https://agentprime.io/advisories/GHSA-66hv-fhcm-7xm7.md)
  `GHSA-66hv-fhcm-7xm7`, `CVE-2023-46651` · Maven `io.jenkins.plugins:warnings-ng`: affected `>=10.5.0, <10.5.1 || <10.4.1`, fixed in `10.5.1`, `10.4.1` · CVSS 4.3 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: Information disclosure, Hard-coded credentials
- [Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison](https://agentprime.io/advisories/GHSA-2xpq-5952-38w3.md)
  `GHSA-2xpq-5952-38w3`, `CVE-2023-46658` · Maven `io.jenkins.plugins:teams-webhook-trigger`: affected `<=0.1.1`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [SaToken authentication bypass vulnerability](https://agentprime.io/advisories/GHSA-w9vh-hv5g-7wmr.md)
  `GHSA-w9vh-hv5g-7wmr`, `CVE-2023-43961` · Maven `cn.dev33:sa-token-core`: affected `<1.36.0`, fixed in `1.36.0` · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2023 · Tags: Authentication bypass, Broken access control
- [Withdrawn Advisory: dom4j XML Entity Expansion vulnerability](https://agentprime.io/advisories/GHSA-fgq9-fc3q-vqmw.md)
  `GHSA-fgq9-fc3q-vqmw`, `CVE-2023-45960` · Maven `org.dom4j:dom4j`: affected `<=2.1.4`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 25 Oct 2023 · Tags: Denial of service
- [SaToken privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-54f6-9mx9-86f7.md)
  `GHSA-54f6-9mx9-86f7`, `CVE-2023-44794` · Maven `cn.dev33:sa-token-core`: affected `<1.37.0`, fixed in `1.37.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Broken access control, CWE-281
- [light-oauth2 missing public key verification](https://agentprime.io/advisories/GHSA-mx47-h5fv-ghwh.md)
  `GHSA-mx47-h5fv-ghwh`, `CVE-2023-31580` · Maven `com.networknt:light-oauth2`: affected `<2.1.27`, fixed in `2.1.27` · CVSS 5.9 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: Weak cryptography or TLS
- [jose4j uses weak cryptographic algorithm](https://agentprime.io/advisories/GHSA-7g24-qg88-p43q.md)
  `GHSA-7g24-qg88-p43q`, `CVE-2023-31582` · Maven `org.bitbucket.b_c:jose4j`: affected `<0.9.3`, fixed in `0.9.3` · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2023 · Tags: Weak cryptography or TLS, CWE-331
- [Sureness uses hardcoded key](https://agentprime.io/advisories/GHSA-3j2f-58rq-g6p7.md)
  `GHSA-3j2f-58rq-g6p7`, `CVE-2023-31581` · Maven `com.usthe.sureness:sureness-core`: affected `<1.0.8`, fixed in `1.0.8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Hard-coded credentials
- [WPS Server Side Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-5pr3-m5hm-9956.md)
  `GHSA-5pr3-m5hm-9956`, `CVE-2023-43795` · Maven `org.geoserver.extension:gs-wps-core`: affected `<2.22.5 || >=2.23.0, <2.23.2`, fixed in `2.22.5`, `2.23.2` · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.69 · Not analysed yet · Published 24 Oct 2023 · Tags: Server-side request forgery (SSRF)
- [Unsecured WMS dynamic styling sld=\<url> parameter affords blind unauthenticated SSRF](https://agentprime.io/advisories/GHSA-cqpc-x2c6-2gmf.md)
  `GHSA-cqpc-x2c6-2gmf`, `CVE-2023-41339` · Maven `org.geoserver:gs-wms` and 1 more: affected `<2.22.5 || >=2.23.0, <2.23.2`, fixed in `2.22.5`, `2.23.2` · CVSS 8.6 High · Not analysed yet · Published 24 Oct 2023 · Tags: Server-side request forgery (SSRF)
- [sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)](https://agentprime.io/advisories/GHSA-h9mw-grgx-2fhf.md)
  `GHSA-h9mw-grgx-2fhf`, `CVE-2023-46122` · Maven `org.scala-sbt:io_2.12` and 3 more: affected `>=1.0.0, <1.9.7`, fixed in `1.9.7` · CVSS 3.9 Low · Not analysed yet · Published 24 Oct 2023 · Tags: Path traversal
- [RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack](https://agentprime.io/advisories/GHSA-mm8h-8587-p46h.md)
  `GHSA-mm8h-8587-p46h`, `CVE-2023-46120` · Maven `com.rabbitmq:amqp-client`: affected `<5.18.0`, fixed in `5.18.0` · CVSS 4.9 Medium · Not analysed yet · Published 24 Oct 2023 · Tags: Denial of service
- [Apache Santuario - XML Security for Java are vulnerable to private key disclosure](https://agentprime.io/advisories/GHSA-xfrj-6vvc-3xm2.md)
  `GHSA-xfrj-6vvc-3xm2`, `CVE-2023-44483` · Maven `org.apache.santuario:xmlsec`: affected `>=2.3.0, <2.3.4 || <2.2.6 || >=3.0.0, <3.0.3`, fixed in `2.3.4`, `2.2.6`, `3.0.3` · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2023 · Tags: Information disclosure
- [Yamcs Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-643f-hpcc-2gv8.md)
  `GHSA-643f-hpcc-2gv8`, `CVE-2023-45280` · Maven `org.yamcs:yamcs`: affected `<5.8.7`, fixed in `5.8.7` · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Yamcs Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-4cqv-q33x-wfxw.md)
  `GHSA-4cqv-q33x-wfxw`, `CVE-2023-45279` · Maven `org.yamcs:yamcs`: affected `<5.8.7`, fixed in `5.8.7` · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Yamcs Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-w4m2-qmh3-2g8f.md)
  `GHSA-w4m2-qmh3-2g8f`, `CVE-2023-45277` · Maven `org.yamcs:yamcs`: affected `<5.8.7`, fixed in `5.8.7` · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2023 · Tags: Path traversal
- [Yamcs API Directory Traversal vulnerability](https://agentprime.io/advisories/GHSA-43fw-536j-w37j.md)
  `GHSA-43fw-536j-w37j`, `CVE-2023-45278` · Maven `org.yamcs:yamcs`: affected `<5.8.7`, fixed in `5.8.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2023 · Tags: Path traversal
- [Apache InLong Deserialization of Untrusted Data Vulnerability](https://agentprime.io/advisories/GHSA-jj32-3pf5-5mv5.md)
  `GHSA-jj32-3pf5-5mv5`, `CVE-2023-46227` · Maven `org.apache.inlong:manager-common` and 1 more: affected `>=1.4.0, <1.9.0`, fixed in `1.9.0` · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2023 · Tags: Insecure deserialization
- [Apache Shenyu Server Side Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-7w8v-5fcq-pvqw.md)
  `GHSA-7w8v-5fcq-pvqw`, `CVE-2023-25753` · Maven `org.apache.shenyu:shenyu-admin` and 1 more: affected `<2.6.0`, fixed in `2.6.0` · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2023 · Tags: Server-side request forgery (SSRF)
- [MySQL Connectors takeover vulnerability](https://agentprime.io/advisories/GHSA-m6vm-37g8-gqvh.md)
  `GHSA-m6vm-37g8-gqvh`, `CVE-2023-22102` · Maven `com.mysql:mysql-connector-j` and 1 more: affected `<8.2.0`, fixed in `8.2.0` · CVSS 8.3 High · Not analysed yet · Published 18 Oct 2023 · Tags: Broken access control
- [Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module](https://agentprime.io/advisories/GHSA-qp68-5v39-r869.md)
  `GHSA-qp68-5v39-r869`, `BIT-liferay-2023-42627`, `CVE-2023-42627` · Maven `com.liferay.commerce:com.liferay.commerce.address.content.web` and 1 more: affected `<4.0.35`, fixed in `4.0.35` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [OpenSearch Issue with tenant read-only permissions](https://agentprime.io/advisories/GHSA-72q2-gwwf-6hrv.md)
  `GHSA-72q2-gwwf-6hrv`, `CVE-2023-45807` · Maven `org.opensearch.plugin:opensearch-security`: affected `>=2.0.0.0, <2.11.0.0 || <1.3.14.0`, fixed in `2.11.0.0`, `1.3.14.0` · CVSS 5.4 Medium · Not analysed yet · Published 17 Oct 2023 · Tags: CWE-281
- [OpenSearch uncontrolled resource consumption](https://agentprime.io/advisories/GHSA-8wx3-324g-w4qq.md)
  `GHSA-8wx3-324g-w4qq` · Maven `org.opensearch.plugin:opensearch-security`: affected `<1.3.14.0 || >=2.0.0.0, <2.11.0.0`, fixed in `1.3.14.0`, `2.11.0.0` · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2023 · Tags: Denial of service
- [WebAuthn4J Spring Security Improper signature counter value handling](https://agentprime.io/advisories/GHSA-v9hx-v6vf-g36j.md)
  `GHSA-v9hx-v6vf-g36j`, `CVE-2023-45669` · Maven `com.webauthn4j:webauthn4j-spring-security-core`: affected `<0.9.1.RELEASE`, fixed in `0.9.1.RELEASE` · CVSS 4.8 Medium · Not analysed yet · Published 17 Oct 2023 · Tags: Authentication bypass
- [XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter](https://agentprime.io/advisories/GHSA-h2rm-29ch-wfmh.md)
  `GHSA-h2rm-29ch-wfmh`, `CVE-2023-45144` · Maven `com.xwiki.identity-oauth:identity-oauth-ui`: affected `>=1.0, <1.6`, fixed in `1.6` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS), Code injection
- [Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu](https://agentprime.io/advisories/GHSA-j5gv-w838-mmcx.md)
  `GHSA-j5gv-w838-mmcx`, `BIT-liferay-2023-44310`, `CVE-2023-44310` · Maven `com.liferay:com.liferay.layout.impl` and 1 more: affected `<6.0.102`, fixed in `6.0.102` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget](https://agentprime.io/advisories/GHSA-hv45-r2f5-fmhj.md)
  `GHSA-hv45-r2f5-fmhj`, `BIT-liferay-2023-42628`, `CVE-2023-42628` · Maven `com.liferay:com.liferay.wiki.web` and 1 more: affected `<7.0.95`, fixed in `7.0.95` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class](https://agentprime.io/advisories/GHSA-49gm-5685-8fxv.md)
  `GHSA-49gm-5685-8fxv`, `BIT-liferay-2023-44311`, `CVE-2023-44311` · Maven `com.liferay:com.liferay.oauth2.provider.rest` and 1 more: affected `<4.0.51`, fixed in `4.0.51` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page](https://agentprime.io/advisories/GHSA-w2g3-j73q-7qv7.md)
  `GHSA-w2g3-j73q-7qv7`, `BIT-liferay-2023-42497`, `CVE-2023-42497` · Maven `com.liferay:com.liferay.translation.web` and 1 more: affected `<2.0.86`, fixed in `2.0.86` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components](https://agentprime.io/advisories/GHSA-j663-6jpj-xx8c.md)
  `GHSA-j663-6jpj-xx8c`, `BIT-liferay-2023-44309`, `CVE-2023-44309` · Maven `com.liferay:com.liferay.fragment.entry.processor.impl` and 1 more: affected `<3.0.25`, fixed in `3.0.25` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page](https://agentprime.io/advisories/GHSA-g44j-f8wm-6622.md)
  `GHSA-g44j-f8wm-6622`, `BIT-liferay-2023-42629`, `CVE-2023-42629` · Maven `com.liferay:com.liferay.asset.categories.admin.web` and 1 more: affected `<5.0.87`, fixed in `5.0.87` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [XWiki Change Request Application UI XSS and remote code execution through change request title](https://agentprime.io/advisories/GHSA-f776-w9v2-7vfj.md)
  `GHSA-f776-w9v2-7vfj`, `CVE-2023-45138` · Maven `org.xwiki.contrib.changerequest:application-changerequest-ui`: affected `>=0.11, <1.9.2`, fixed in `1.9.2` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.72 · Not analysed yet · Published 17 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Insufficient Verification of Data Authenticity in Apache InLong](https://agentprime.io/advisories/GHSA-wj6q-chpv-mcrx.md)
  `GHSA-wj6q-chpv-mcrx`, `CVE-2023-43666` · Maven `org.apache.inlong:inlong`: affected `>=1.4.0, <1.9.0`, fixed in `1.9.0` · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: CWE-345
- [Authorization Bypass in Apache InLong](https://agentprime.io/advisories/GHSA-rp6x-ggw6-8g56.md)
  `GHSA-rp6x-ggw6-8g56`, `CVE-2023-43668` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.4.0, <1.9.0`, fixed in `1.9.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2023 · Tags: Insecure deserialization, Broken access control
- [SQL Injection in Apache InLong](https://agentprime.io/advisories/GHSA-fpcf-qr79-hjqp.md)
  `GHSA-fpcf-qr79-hjqp`, `CVE-2023-43667` · Maven `org.apache.inlong:inlong`: affected `>=1.4.0, <1.8.0`, fixed in `1.8.0` · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2023 · Tags: Other injection, SQL injection
- [Duplicate Advisory: Denial of Service in JSON-Java](https://agentprime.io/advisories/GHSA-rm7j-f5g5-27vv.md)
  `GHSA-rm7j-f5g5-27vv` · Maven `org.json:json`: affected `<20231013`, fixed in `20231013` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 12 Oct 2023 · Tags: Denial of service
- [Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper](https://agentprime.io/advisories/GHSA-7286-pgfv-vxvh.md)
  `GHSA-7286-pgfv-vxvh`, `BIT-zookeeper-2023-44981`, `CVE-2023-44981` · Maven `org.apache.zookeeper:zookeeper`: affected `<3.7.2 || >=3.8.0, <3.8.3 || >=3.9.0, <3.9.1`, fixed in `3.7.2`, `3.8.3`, `3.9.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2023 · Tags: Broken access control
- [io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack](https://agentprime.io/advisories/GHSA-xpw8-rcwv-8f8p.md)
  `GHSA-xpw8-rcwv-8f8p` · Maven `io.netty:netty-codec-http2`: affected `<4.1.100.Final`, fixed in `4.1.100.Final` · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2023 · Tags: Denial of service
- [Apache Tomcat Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-r6j3-px5g-cq3x.md)
  `GHSA-r6j3-px5g-cq3x`, `BIT-tomcat-2023-45648`, `CVE-2023-45648` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.0-M12 || >=10.1.0-M1, <10.1.14 || >=9.0.0-M1, <9.0.81 || >=8.5.0, <8.5.94`, fixed in `11.0.0-M12`, `10.1.14`, `9.0.81`, `8.5.94` · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-20
- [HTTP/2 Stream Cancellation Attack](https://agentprime.io/advisories/GHSA-qppj-fm5r-hxr3.md)
  `GHSA-qppj-fm5r-hxr3`, `BIT-apisix-2023-44487`, `BIT-aspnet-core-2023-44487`, `BIT-contour-2023-44487`, `BIT-dotnet-2023-44487`, `BIT-dotnet-sdk-2023-44487`, `BIT-envoy-2023-44487`, `BIT-golang-2023-44487`, `BIT-jenkins-2023-44487`, `BIT-kong-2023-44487`, `BIT-nginx-2023-44487`, `BIT-nginx-gateway-2023-44487`, `BIT-node-2023-44487`, `BIT-node-min-2023-44487`, `BIT-solr-2023-44487`, `BIT-tomcat-2023-44487`, `BIT-varnish-2023-44487`, `CVE-2023-44487` · Go `golang.org/x/net` and 10 more: affected `<0.17.0`, fixed in `0.17.0` · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 10 Oct 2023 · Tags: Denial of service
- [HTTP/2 HPACK integer overflow and buffer allocation](https://agentprime.io/advisories/GHSA-wgh7-54f2-x98r.md)
  `GHSA-wgh7-54f2-x98r`, `BIT-jenkins-2023-36478`, `CVE-2023-36478` · Maven `org.eclipse.jetty.http2:http2-hpack` and 1 more: affected `>=10.0.0, <10.0.16 || >=11.0.0, <11.0.16 || >=9.3.0, <9.4.53`, fixed in `10.0.16`, `11.0.16`, `9.4.53` · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2023 · Tags: Memory corruption, Denial of service
- [Apache Tomcat Incomplete Cleanup vulnerability](https://agentprime.io/advisories/GHSA-jm7m-8jh6-29hp.md)
  `GHSA-jm7m-8jh6-29hp`, `BIT-tomcat-2023-42794`, `CVE-2023-42794` · Maven `org.apache.tomcat:tomcat-coyote`: affected `>=9.0.70, <9.0.81 || >=8.5.85, <8.5.94`, fixed in `9.0.81`, `8.5.94` · CVSS 5.9 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-459
- [Apache Tomcat Incomplete Cleanup vulnerability](https://agentprime.io/advisories/GHSA-g8pj-r55q-5c2v.md)
  `GHSA-g8pj-r55q-5c2v`, `BIT-tomcat-2023-42795`, `CVE-2023-42795` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 3 more: affected `>=10.1.0-M1, <10.1.14 || >=9.0.0-M1, <9.0.81 || >=8.5.0, <8.5.94 || >=11.0.0-M1, <11.0.0-M12`, fixed in `10.1.14`, `9.0.81`, `8.5.94`, `11.0.0-M12` · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-459
- [Microsoft Common Data Model SDK Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-vm2m-7hpw-fpmq.md)
  `GHSA-vm2m-7hpw-fpmq`, `CVE-2023-36566`, `PYSEC-2026-1261` · Maven `com.microsoft.commondatamodel:objectmodel` and 2 more: affected `<1.7.4`, fixed in `1.7.4` · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-20
- [Denial of service vulnerability on creating a Launch with too many recursively nested elements in reportportal](https://agentprime.io/advisories/GHSA-mj24-gpw7-23m9.md)
  `GHSA-mj24-gpw7-23m9`, `CVE-2023-25822` · Maven `com.epam.reportportal:service-api`: affected `<5.10.0`, fixed in `5.10.0` · CVSS 6.3 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: Denial of service
- [mXSS in AntiSamy](https://agentprime.io/advisories/GHSA-pcf2-gh6g-h5r2.md)
  `GHSA-pcf2-gh6g-h5r2`, `CVE-2023-43643` · Maven `org.owasp.antisamy:antisamy`: affected `<1.7.4`, fixed in `1.7.4` · CVSS 6.1 Medium · Not analysed yet · Published 9 Oct 2023 · Tags: Cross-site scripting (XSS)
- [ThingsBoard Server-Side Template Injection](https://agentprime.io/advisories/GHSA-6pgr-j9v4-xfvv.md)
  `GHSA-6pgr-j9v4-xfvv`, `CVE-2023-45303` · Maven `org.thingsboard:thingsboard`: affected `<3.5`, fixed in `3.5` · CVSS 8.4 High · Not analysed yet · Published 6 Oct 2023 · Tags: Other injection
- [io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud](https://agentprime.io/advisories/GHSA-qw22-8w9r-864h.md)
  `GHSA-qw22-8w9r-864h`, `CVE-2023-36820` · Maven `io.micronaut.security:micronaut-security-oauth2`: affected `>=3.11.0, <3.11.1 || >=3.10.0, <3.10.2 || >=3.9.0, <3.9.6 || >=3.8.0, <3.8.4 || >=3.7.0, <3.7.4 || >=3.6.0, <3.6.6 || >=3.5.0, <3.5.3 || >=3.4.0, <3.4.3 || >=3.3.0, <3.3.2 || >=3.2.0, <3.2.4 || >=3.1.0, <3.1.2`, fixed in `3.11.1`, `3.10.2`, `3.9.6`, `3.8.4`, `3.7.4`, `3.6.6`, `3.5.3`, `3.4.3`, `3.3.2`, `3.2.4`, `3.1.2` · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2023 · Tags: Broken access control
- [Quarkus OIDC can leak both ID and access tokens](https://agentprime.io/advisories/GHSA-6hc9-cf8x-hf83.md)
  `GHSA-6hc9-cf8x-hf83`, `CVE-2023-1584` · Maven `io.quarkus:quarkus-oidc`: affected `<2.13.0.Final || >=3.0.0, <3.1.0.Final`, fixed in `2.13.0.Final`, `3.1.0.Final` · CVSS 7.5 High · Not analysed yet · Published 4 Oct 2023 · Tags: Information disclosure
- [Withdrawn Advisory: Netty-handler does not validate host names by default](https://agentprime.io/advisories/GHSA-57m8-f3v5-hm5m.md)
  `GHSA-57m8-f3v5-hm5m`, `CVE-2023-4586` · Maven `io.netty:netty-handler`: affected `>=4.1.0.Final, <=4.1.99.Final`, no fixed version yet · CVSS 7.4 High · Withdrawn · Not analysed yet · Published 4 Oct 2023 · Tags: Weak cryptography or TLS, CWE-20
- [Presto JDBC Server-Side Request Forgery by nextUri](https://agentprime.io/advisories/GHSA-86q5-qcjc-7pv4.md)
  `GHSA-86q5-qcjc-7pv4` · Maven `com.facebook.presto:presto-jdbc`: affected `<=0.283`, no fixed version yet · CVSS 7.6 High · Not analysed yet · Published 3 Oct 2023 · Tags: Server-side request forgery (SSRF)
- [Presto JDBC Server-Side Request Forgery by redirect](https://agentprime.io/advisories/GHSA-xm7x-f3w2-4hjm.md)
  `GHSA-xm7x-f3w2-4hjm` · Maven `com.facebook.presto:presto-jdbc`: affected `<=0.283`, no fixed version yet · CVSS 7.6 High · Not analysed yet · Published 3 Oct 2023 · Tags: Server-side request forgery (SSRF)
- [Apache Avro Java SDK vulnerable to Improper Input Validation](https://agentprime.io/advisories/GHSA-rhrv-645h-fjfh.md)
  `GHSA-rhrv-645h-fjfh`, `CVE-2023-39410`, `PYSEC-2023-188` · Maven `org.apache.avro:avro`: affected `<1.11.3`, fixed in `1.11.3` · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2023 · Tags: Insecure deserialization, CWE-20
- [Undertow vulnerable to denial of service](https://agentprime.io/advisories/GHSA-65h2-wf7m-q2v8.md)
  `GHSA-65h2-wf7m-q2v8`, `CVE-2023-3223` · Maven `io.undertow:undertow-parent`: affected `<2.2.24.Final`, fixed in `2.2.24.Final` · CVSS 7.5 High · Not analysed yet · Published 27 Sept 2023 · Tags: Denial of service
- [codehaus-plexus vulnerable to XML injection](https://agentprime.io/advisories/GHSA-jcwr-x25h-x5fh.md)
  `GHSA-jcwr-x25h-x5fh`, `CVE-2022-4245` · Maven `org.codehaus.plexus:plexus-utils`: affected `<3.0.24`, fixed in `3.0.24` · CVSS 4.3 Medium · Not analysed yet · Published 25 Sept 2023 · Tags: Other injection, XML external entities (XXE)
- [plexus-codehaus vulnerable to directory traversal](https://agentprime.io/advisories/GHSA-g6ph-x5wf-g337.md)
  `GHSA-g6ph-x5wf-g337`, `CVE-2022-4244` · Maven `org.codehaus.plexus:plexus-utils`: affected `<3.0.24`, fixed in `3.0.24` · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2023 · Tags: Path traversal
- [snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact](https://agentprime.io/advisories/GHSA-55g7-9cwv-5qfv.md)
  `GHSA-55g7-9cwv-5qfv`, `CVE-2023-43642` · Maven `org.xerial.snappy:snappy-java`: affected `<1.1.10.4`, fixed in `1.1.10.4` · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2023 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDIzLTA5LTI1VDE4OjMwOjE4LjAwMDAwMFoiLCJHSFNBLTU1ZzctOWN3di01cWZ2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDIzLTEwLTI1VDE4OjMyOjI1LjAwMDAwMFoiLCJHSFNBLTlnZ3ctaDltZi00amg3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDIzLTEwLTI1VDE4OjMyOjI1LjAwMDAwMFoiLCJHSFNBLTlnZ3ctaDltZi00amg3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.