# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [Cross-Site Request Forgery with QueryOnXWiki allows arbitrary database queries](https://agentprime.io/advisories/GHSA-4f4c-rhjv-4wgv.md) `GHSA-4f4c-rhjv-4wgv`, `CVE-2023-48293` · Maven `org.xwiki.contrib:xwiki-application-admintools`: affected `<4.5.1`, fixed in `4.5.1` · CVSS 8.8 High · Not analysed yet · Published 20 Nov 2023 · Tags: Cross-site request forgery (CSRF) - [Run Shell Command allows Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-8jpr-ff92-hpf9.md) `GHSA-8jpr-ff92-hpf9`, `CVE-2023-48292` · Maven `org.xwiki.contrib:xwiki-application-admintools`: affected `>=4.4, <4.5.1`, fixed in `4.5.1` · CVSS 9.7 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.23 · Not analysed yet · Published 20 Nov 2023 · Tags: Cross-site request forgery (CSRF) - [Whole content of all documents of all wikis exposed to anybody with view right on Solr suggest service](https://agentprime.io/advisories/GHSA-7fqr-97j7-jgf4.md) `GHSA-7fqr-97j7-jgf4`, `CVE-2023-48241` · Maven `org.xwiki.platform:xwiki-platform-search-solr-query`: affected `>=6.3-milestone-2, <14.10.15 || >=15.0-rc-1, <15.5.1`, fixed in `14.10.15`, `15.5.1` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.73 · Not analysed yet · Published 20 Nov 2023 · Tags: Broken access control - [Cookies are sent to external images in rendered diff (and server side request forgery)](https://agentprime.io/advisories/GHSA-7rfg-6273-f5wp.md) `GHSA-7rfg-6273-f5wp`, `CVE-2023-48240` · Maven `org.xwiki.platform:xwiki-platform-diff-xml`: affected `>=11.10.1, <14.10.15 || >=15.0-rc-1, <15.5.1 || >=15.6-rc-1, <15.6`, fixed in `14.10.15`, `15.5.1`, `15.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Nov 2023 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-281 - [Apache Derby: LDAP injection vulnerability in authenticator](https://agentprime.io/advisories/GHSA-rcjc-c4pj-xxrp.md) `GHSA-rcjc-c4pj-xxrp`, `CVE-2022-46337` · Maven `org.apache.derby:derby`: affected `>=10.1.1.0, <=10.1.3.1 || >=10.2.1.6, <=10.2.2.0 || >=10.3.1.4, <=10.3.3.0 || >=10.4.1.3, <=10.4.2.0 || >=10.5.1.1, <=10.5.3.0 || >=10.6.1.0, <=10.6.2.1 || >=10.8.1.2, <=10.8.3.0 || >=10.10.1.1, <=10.10.2.0 || >=10.14.2.0, <10.14.2.1 || >=10.16.1.1, <10.16.1.2 || >=10.15.1.3, <10.15.2.1`, fixed in `10.14.2.1`, `10.16.1.2`, `10.15.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Nov 2023 · Tags: Other injection, Code injection - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-qjmx-q5m4-xqf5.md) `GHSA-qjmx-q5m4-xqf5`, `CVE-2023-40816` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-hhcf-79pm-r8r9.md) `GHSA-hhcf-79pm-r8r9`, `CVE-2023-40815` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-chj5-8wxj-rxg8.md) `GHSA-chj5-8wxj-rxg8`, `CVE-2023-40814` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-96q4-7fwr-gmxh.md) `GHSA-96q4-7fwr-gmxh`, `CVE-2023-40817` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-5phw-6g3r-55xx.md) `GHSA-5phw-6g3r-55xx`, `CVE-2023-40813` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-mfp5-vh58-3j3r.md) `GHSA-mfp5-vh58-3j3r`, `CVE-2023-40809` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS), Code injection - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-gx82-jm5q-gfw2.md) `GHSA-gx82-jm5q-gfw2`, `CVE-2023-40810` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting in OpenCRX](https://agentprime.io/advisories/GHSA-3g79-j8hq-r4xv.md) `GHSA-3g79-j8hq-r4xv`, `CVE-2023-40812` · Maven `org.opencrx:opencrx-core-models`: affected `<=5.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2023 · Tags: Cross-site scripting (XSS) - [Liferay Portal XSS with \`p_l_back_url_title\` on edit content page](https://agentprime.io/advisories/GHSA-v32m-pf9q-p3xg.md) `GHSA-v32m-pf9q-p3xg`, `CVE-2023-47797` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.3.94, <7.4.3.96`, fixed in `7.4.3.96` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Nov 2023 · Tags: Cross-site scripting (XSS) - [OpenNMS Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-c6xw-hg9q-3c9f.md) `GHSA-c6xw-hg9q-3c9f`, `CVE-2023-40314` · Maven `org.opennms:opennms-webapp`: affected `<32.0.5`, fixed in `32.0.5` · CVSS 5.8 Medium · Not analysed yet · Published 17 Nov 2023 · Tags: Cross-site scripting (XSS), CWE-20 - [Authenticated Rundeck users can view or delete jobs they do not have authorization for.](https://agentprime.io/advisories/GHSA-phmw-jx86-x666.md) `GHSA-phmw-jx86-x666`, `CVE-2023-48222` · Maven `org.rundeck:rundeck`: affected `>=4.12.0, <4.17.3`, fixed in `4.17.3` · CVSS 8.1 High · Not analysed yet · Published 16 Nov 2023 · Tags: Broken access control - [Authenticated users can view job names and groups they do not have authorization to view](https://agentprime.io/advisories/GHSA-xvmv-4rx6-x6jx.md) `GHSA-xvmv-4rx6-x6jx`, `CVE-2023-47112` · Maven `org.rundeck:rundeckapp`: affected `>=4.17.0, <4.17.3`, fixed in `4.17.3` · CVSS 4.3 Medium · Not analysed yet · Published 16 Nov 2023 · Tags: Broken access control - [H2O local file inclusion vulnerability](https://agentprime.io/advisories/GHSA-6mv8-95x5-xcq9.md) `GHSA-6mv8-95x5-xcq9`, `CVE-2023-6038` · Maven `ai.h2o:h2o-core`: affected `<=3.40.0.4`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Nov 2023 · Tags: Broken access control, CWE-29 - [Apache Hadoop allows local user to gain root privileges](https://agentprime.io/advisories/GHSA-94jh-j374-9r3j.md) `GHSA-94jh-j374-9r3j`, `CVE-2023-26031` · Maven `org.apache.hadoop:hadoop-yarn-project`: affected `>=3.3.1, <3.3.5`, fixed in `3.3.5` · CVSS 7.5 High · Not analysed yet · Published 16 Nov 2023 · Tags: CWE-426 - [xxl-job-admin vulnerable to Remote Code Execution](https://agentprime.io/advisories/GHSA-x98f-2rgf-qwqh.md) `GHSA-x98f-2rgf-qwqh`, `CVE-2023-48089` · Maven `com.xuxueli:xxl-job-admin`: affected `<=2.4.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 15 Nov 2023 - [Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain](https://agentprime.io/advisories/GHSA-p62q-5483-h57v.md) `GHSA-p62q-5483-h57v`, `CVE-2023-5720` · Maven `io.quarkus:quarkus-project`: affected `>=3.0.0.CR1, <=3.5.1`, no fixed version yet · CVSS 7.7 High · Not analysed yet · Published 15 Nov 2023 · Tags: CWE-526 - [Zip slip in mleap](https://agentprime.io/advisories/GHSA-897x-xvj8-42rq.md) `GHSA-897x-xvj8-42rq`, `CVE-2023-5245` · Maven `ml.combust.mleap:mleap-runtime_2.12`: affected `<0.23.1`, fixed in `0.23.1` · CVSS 7.5 High · Not analysed yet · Published 15 Nov 2023 · Tags: Path traversal - [xxl-job-admin vulnerable to Cross Site Scripting](https://agentprime.io/advisories/GHSA-6733-7rp7-vf3m.md) `GHSA-6733-7rp7-vf3m`, `CVE-2023-48088` · Maven `com.xuxueli:xxl-job-admin`: affected `<=2.4.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 15 Nov 2023 · Tags: Cross-site scripting (XSS) - [xxl-job-admin vulnerable to Insecure Permissions](https://agentprime.io/advisories/GHSA-3w8r-3jh9-89v9.md) `GHSA-3w8r-3jh9-89v9`, `CVE-2023-48087` · Maven `com.xuxueli:xxl-job-admin`: affected `<=2.4.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 15 Nov 2023 · Tags: Broken access control - [In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack](https://agentprime.io/advisories/GHSA-xjhv-p3fv-x24r.md) `GHSA-xjhv-p3fv-x24r`, `CVE-2023-34062` · Maven `io.projectreactor.netty:reactor-netty-http`: affected `>=1.1.0, <1.1.13 || >=1.0.0, <1.0.39`, fixed in `1.1.13`, `1.0.39` · CVSS 7.5 High · Not analysed yet · Published 15 Nov 2023 · Tags: Path traversal - [Java: DoS Vulnerability in JSON-JAVA](https://agentprime.io/advisories/GHSA-4jq9-2xhw-jpx7.md) `GHSA-4jq9-2xhw-jpx7`, `CVE-2023-5072` · Maven `org.json:json`: affected `<20231013`, fixed in `20231013` · CVSS 7.5 High · Not analysed yet · Published 14 Nov 2023 · Tags: Denial of service, CWE-358 - [Signing DynamoDB Sets when using the AWS Database Encryption SDK.](https://agentprime.io/advisories/GHSA-72fp-w44g-625q.md) `GHSA-72fp-w44g-625q` · Maven `software.amazon.cryptography:aws-database-encryption-sdk-dynamodb`: affected `>=3.0.0, <3.1.1`, fixed in `3.1.1` · No CVSS score · Not analysed yet · Published 9 Nov 2023 - [Duplicate Advisory: Eclipse IDE XXE in eclipse.platform](https://agentprime.io/advisories/GHSA-cc4w-3cff-j8fw.md) `GHSA-cc4w-3cff-j8fw` · Maven `org.eclipse.platform:eclipse.platform`: affected `<4.29`, fixed in `4.29` · CVSS 5.0 Medium · Withdrawn · Not analysed yet · Published 9 Nov 2023 · Tags: XML external entities (XXE) - [XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu](https://agentprime.io/advisories/GHSA-j9rc-w3wv-fv62.md) `GHSA-j9rc-w3wv-fv62`, `CVE-2023-46732` · Maven `org.xwiki.platform:xwiki-platform-flamingo-skin-resources`: affected `>=9.7-rc-1, <14.10.14 || >=15.0-rc-1, <15.5.1`, fixed in `14.10.14`, `15.5.1` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Nov 2023 · Tags: Cross-site scripting (XSS) - [XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest](https://agentprime.io/advisories/GHSA-62pr-qqf7-hh89.md) `GHSA-62pr-qqf7-hh89`, `CVE-2023-46731` · Maven `org.xwiki.platform:xwiki-platform-administration` and 1 more: affected `<14.10.14`, fixed in `14.10.14` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.90 · Not analysed yet · Published 8 Nov 2023 · Tags: Code injection - [Apache UIMA Java SDK Deserialization of Untrusted Data, Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-5r8j-qmcm-7g7q.md) `GHSA-5r8j-qmcm-7g7q`, `CVE-2023-39913` · Maven `org.apache.uima:uimaj`: affected `<3.5.0`, fixed in `3.5.0` · CVSS 8.8 High · Not analysed yet · Published 8 Nov 2023 · Tags: Insecure deserialization, CWE-20 - [wildfly-core Exposure of Sensitive Information to an Unauthorized Actor vulnerability](https://agentprime.io/advisories/GHSA-26qx-4m49-6cfr.md) `GHSA-26qx-4m49-6cfr`, `CVE-2023-4061` · Maven `org.wildfly.core:wildfly-controller`: affected `<22.0.0.Final`, fixed in `22.0.0.Final` · CVSS 6.5 Medium · Not analysed yet · Published 8 Nov 2023 · Tags: Information disclosure - [XWiki Platform privilege escalation from script right to programming right through title displayer](https://agentprime.io/advisories/GHSA-rmxw-c48h-2vf5.md) `GHSA-rmxw-c48h-2vf5`, `CVE-2023-46244` · Maven `org.xwiki.platform:xwiki-platform-display-api`: affected `>=3.2-milestone-3, <14.10.7 || >=15.0, <15.2-rc-1`, fixed in `14.10.7`, `15.2-rc-1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2023 · Tags: Broken access control - [XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action](https://agentprime.io/advisories/GHSA-g2qq-c5j9-5w5w.md) `GHSA-g2qq-c5j9-5w5w`, `CVE-2023-46243` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=15.0, <15.2-rc-1 || >=1.0, <14.10.6`, fixed in `15.2-rc-1`, `14.10.6` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2023 · Tags: Code injection - [XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token](https://agentprime.io/advisories/GHSA-hgpw-6p4h-j6h5.md) `GHSA-hgpw-6p4h-j6h5`, `CVE-2023-46242` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=1.0, <14.10.7 || >=15.0, <15.2-rc-1`, fixed in `14.10.7`, `15.2-rc-1` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2023 · Tags: Code injection, Cross-site request forgery (CSRF) - [Eclipse Parsson Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-g8p6-p27c-52fx.md) `GHSA-g8p6-p27c-52fx`, `CVE-2023-4043` · Maven `org.eclipse.parsson:project`: affected `>=1.1.0, <1.1.4 || <1.0.5`, fixed in `1.1.4`, `1.0.5` · CVSS 5.9 Medium · Not analysed yet · Published 3 Nov 2023 · Tags: Denial of service, CWE-20 - [Eclipse Glassfish remote code execution issue](https://agentprime.io/advisories/GHSA-2mw4-wj8c-7f93.md) `GHSA-2mw4-wj8c-7f93`, `CVE-2023-5763` · Maven `org.glassfish.main.orb:orb-connector`: affected `>=5.0.0, <7.0.0`, fixed in `7.0.0` · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2023 · Tags: CWE-20, CWE-913 - [Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/GHSA-xr8c-mq5x-5f56.md) `GHSA-xr8c-mq5x-5f56`, `CVE-2023-31579` · Maven `top.tangyh.basic:lamp-core` and 1 more: affected `<3.8.1`, fixed in `3.8.1` · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2023 · Tags: Hard-coded credentials - [OpenCRX allows a remote attacker to execute arbitrary code via a crafted request](https://agentprime.io/advisories/GHSA-q74f-rf27-8hxc.md) `GHSA-q74f-rf27-8hxc`, `CVE-2023-46502` · Maven `org.opencrx:opencrx-client`: affected `<5.3.0`, fixed in `5.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2023 · Tags: XML external entities (XXE), Server-side request forgery (SSRF) - [DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998](https://agentprime.io/advisories/GHSA-7c2q-5qmr-v76q.md) `GHSA-7c2q-5qmr-v76q` · Maven `org.owasp.esapi:esapi`: affected `<2.5.2.0`, fixed in `2.5.2.0` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2023 - [Apache ActiveMQ is vulnerable to Remote Code Execution](https://agentprime.io/advisories/GHSA-crg9-44h2-xw35.md) `GHSA-crg9-44h2-xw35`, `BIT-activemq-2023-46604`, `CVE-2023-46604` · Maven `org.apache.activemq:activemq-client` and 1 more: affected `<5.15.16 || >=5.16.0, <5.16.7 || >=5.17.0, <5.17.6 || >=5.18.0, <5.18.3`, fixed in `5.15.16`, `5.16.7`, `5.17.6`, `5.18.3` · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 27 Oct 2023 · Tags: Insecure deserialization - [Elasticsearch vulnerable to stack overflow in the search API](https://agentprime.io/advisories/GHSA-qwrx-45xf-jjf7.md) `GHSA-qwrx-45xf-jjf7`, `BIT-elasticsearch-2023-31419`, `CVE-2023-31419` · Maven `org.elasticsearch:elasticsearch`: affected `>=7.0.0, <7.17.13 || >=8.0.0, <8.9.1`, fixed in `7.17.13`, `8.9.1` · CVSS 6.5 Medium · EPSS 0.61 · Not analysed yet · Published 26 Oct 2023 · Tags: Memory corruption - [Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs](https://agentprime.io/advisories/GHSA-99pc-69q9-jxf2.md) `GHSA-99pc-69q9-jxf2`, `BIT-elasticsearch-2023-31417`, `CVE-2023-31417` · Maven `org.elasticsearch:elasticsearch`: affected `>=7.0.0, <7.17.13 || >=8.0.0, <8.9.2`, fixed in `7.17.13`, `8.9.2` · CVSS 4.1 Medium · Not analysed yet · Published 26 Oct 2023 · Tags: Information disclosure - [Elasticsearch vulnerable to Uncontrolled Resource Consumption](https://agentprime.io/advisories/GHSA-2cqf-6xv9-f22w.md) `GHSA-2cqf-6xv9-f22w`, `BIT-elasticsearch-2023-31418`, `CVE-2023-31418` · Maven `org.elasticsearch:elasticsearch`: affected `<7.17.13 || >=8.0.0, <8.9.0`, fixed in `7.17.13`, `8.9.0` · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2023 · Tags: Denial of service - [XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages](https://agentprime.io/advisories/GHSA-93gh-jgjj-r929.md) `GHSA-93gh-jgjj-r929`, `CVE-2023-45137` · Maven `org.xwiki.platform:xwiki-platform-web` and 1 more: affected `>=3.1-milestone-2, <13.4-rc-1`, fixed in `13.4-rc-1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Cross-site scripting (XSS) - [XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled](https://agentprime.io/advisories/GHSA-qcj9-gcpg-4w2w.md) `GHSA-qcj9-gcpg-4w2w`, `CVE-2023-45136` · Maven `org.xwiki.platform:xwiki-platform-web-templates`: affected `>=12.0-rc-1, <14.10.12 || >=15.0-rc-1, <15.5-rc-1`, fixed in `14.10.12`, `15.5-rc-1` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Cross-site scripting (XSS) - [XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title](https://agentprime.io/advisories/GHSA-ghf6-2f42-mjh9.md) `GHSA-ghf6-2f42-mjh9`, `CVE-2023-45135` · Maven `org.xwiki.platform:xwiki-platform-web` and 1 more: affected `>=7.2-milestone-2, <14.10.12`, fixed in `14.10.12` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-116 - [XWiki Platform XSS vulnerability from account in the create page form via template provider](https://agentprime.io/advisories/GHSA-gr82-8fj2-ggc3.md) `GHSA-gr82-8fj2-ggc3`, `CVE-2023-45134` · Maven `org.xwiki.platform:xwiki-platform-web` and 2 more: affected `>=3.1-milestone-1, <13.4-rc-1`, fixed in `13.4-rc-1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Cross-site scripting (XSS) - [org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter](https://agentprime.io/advisories/GHSA-vcvr-v426-3m3m.md) `GHSA-vcvr-v426-3m3m`, `CVE-2023-37913` · Maven `org.xwiki.platform:xwiki-platform-office-importer`: affected `>=3.5-milestone-1, <14.10.8 || >=15.0-rc-1, <15.3-rc-1`, fixed in `14.10.8`, `15.3-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Path traversal - [XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro](https://agentprime.io/advisories/GHSA-35j5-m29r-xfq5.md) `GHSA-35j5-m29r-xfq5`, `CVE-2023-37912` · Maven `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and 1 more: affected `<14.10.6`, fixed in `14.10.6` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Privilege escalation - [org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents](https://agentprime.io/advisories/GHSA-gh64-qxh5-4m33.md) `GHSA-gh64-qxh5-4m33`, `CVE-2023-37911` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=9.4-rc-1, <14.10.8 || >=15.0-rc-1, <15.3-rc-1`, fixed in `14.10.8`, `15.3-rc-1` · CVSS 6.5 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: Information disclosure - [org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move](https://agentprime.io/advisories/GHSA-rwwx-6572-mp29.md) `GHSA-rwwx-6572-mp29`, `CVE-2023-37910` · Maven `org.xwiki.platform:xwiki-platform-attachment-api`: affected `>=14.0-rc-1, <14.4.8 || >=14.5, <14.10.4`, fixed in `14.4.8`, `14.10.4` · CVSS 8.1 High · Not analysed yet · Published 25 Oct 2023 · Tags: Broken access control - [Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet](https://agentprime.io/advisories/GHSA-v2rr-xw95-wcjx.md) `GHSA-v2rr-xw95-wcjx`, `CVE-2023-37909` · Maven `org.xwiki.platform:xwiki-platform-menu` and 1 more: affected `>=5.1-rc-1, <14.10.8`, fixed in `14.10.8` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Code injection - [org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability](https://agentprime.io/advisories/GHSA-663w-2xp3-5739.md) `GHSA-663w-2xp3-5739`, `CVE-2023-37908` · Maven `org.xwiki.rendering:xwiki-rendering-xml`: affected `>=14.6-rc-1, <14.10.4`, fixed in `14.10.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Cross-site scripting (XSS), CWE-86 - [Jenkins lambdatest-automation Plugin missing permission check](https://agentprime.io/advisories/GHSA-vw64-g7c6-mm7g.md) `GHSA-vw64-g7c6-mm7g`, `CVE-2023-46652` · Maven `org.jenkins-ci.plugins:lambdatest-automation`: affected `<1.20.10`, fixed in `1.20.10` · CVSS 4.3 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: Broken access control - [Stored XSS vulnerability in Jenkins GitHub Plugin](https://agentprime.io/advisories/GHSA-mv77-fj63-q5w8.md) `GHSA-mv77-fj63-q5w8`, `CVE-2023-46650` · Maven `com.coravy.hudson.plugins.github:github`: affected `<1.37.3.1`, fixed in `1.37.3.1` · CVSS 8.0 High · Not analysed yet · Published 25 Oct 2023 · Tags: Cross-site scripting (XSS) - [Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion](https://agentprime.io/advisories/GHSA-jx7x-rf3f-j644.md) `GHSA-jx7x-rf3f-j644`, `CVE-2023-46654` · Maven `org.jenkins-ci.plugins:electricflow`: affected `<1.1.33`, fixed in `1.1.33` · CVSS 8.0 High · Not analysed yet · Published 25 Oct 2023 · Tags: Path traversal - [Jenkins Edgewall Trac Plugin vulnerable to Stored XSS](https://agentprime.io/advisories/GHSA-jwx3-2hq3-682c.md) `GHSA-jwx3-2hq3-682c`, `CVE-2023-46659` · Maven `org.jenkins-ci.plugins:trac`: affected `<=1.13`, no fixed version yet · CVSS 8.0 High · Not analysed yet · Published 25 Oct 2023 · Tags: Cross-site scripting (XSS) - [Jenkins lambdatest-automation Plugin may expose Credentials access token](https://agentprime.io/advisories/GHSA-hpv3-f5p7-pxj9.md) `GHSA-hpv3-f5p7-pxj9`, `CVE-2023-46653` · Maven `org.jenkins-ci.plugins:lambdatest-automation`: affected `<1.21.0`, fixed in `1.21.0` · CVSS 2.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: Information disclosure - [Jenkins CloudBees CD Plugin vulnerable to arbitrary file read](https://agentprime.io/advisories/GHSA-9ggw-h9mf-4jh7.md) `GHSA-9ggw-h9mf-4jh7`, `CVE-2023-46655` · Maven `org.jenkins-ci.plugins:electricflow`: affected `<1.1.33`, fixed in `1.1.33` · CVSS 6.5 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: Path traversal Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .