# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [Apache Struts vulnerable to path traversal](https://agentprime.io/advisories/GHSA-2j39-qcjm-428w.md) `GHSA-2j39-qcjm-428w`, `CVE-2023-50164` · Maven `org.apache.struts:struts2-core`: affected `>=2.0.0, <2.5.33 || >=6.0.0, <6.3.0.2`, fixed in `2.5.33`, `6.3.0.2` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.81 · Not analysed yet · Published 7 Dec 2023 · Tags: Information disclosure - [Quarkus Cache Runtime exposes sensitive information to an unauthorized actor](https://agentprime.io/advisories/GHSA-xfv5-jqgp-vqhj.md) `GHSA-xfv5-jqgp-vqhj`, `CVE-2023-6393` · Maven `io.quarkus:quarkus-cache`: affected `>=3.3.0.CR1, <3.5.2 || >=3.2.0.CR1, <3.2.9.Final`, fixed in `3.5.2`, `3.2.9.Final` · CVSS 5.3 Medium · Not analysed yet · Published 6 Dec 2023 · Tags: Information disclosure - [pubnub Insufficient Entropy vulnerability](https://agentprime.io/advisories/GHSA-5844-q3fc-56rh.md) `GHSA-5844-q3fc-56rh`, `CVE-2023-26154`, `GO-2023-2385`, `PKSA-fyvg-jy6y-h7w5`, `PYSEC-2026-1807` · crates.io `pubnub` and 11 more: affected `<0.4.0`, fixed in `0.4.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 Dec 2023 · Tags: CWE-331 - [Data leak of password hash through change requests](https://agentprime.io/advisories/GHSA-2fr7-cc7p-p45q.md) `GHSA-2fr7-cc7p-p45q`, `CVE-2023-49280` · Maven `org.xwiki.contrib.changerequest:application-changerequest-default`: affected `>=0.1, <1.10`, fixed in `1.10` · CVSS 7.7 High · Not analysed yet · Published 5 Dec 2023 · Tags: Hard-coded credentials - [Elasticsearch-hadoop Unsafe Deserialization](https://agentprime.io/advisories/GHSA-rv74-m283-5j95.md) `GHSA-rv74-m283-5j95`, `BIT-elasticsearch-2023-46674`, `CVE-2023-46674` · Maven `org.elasticsearch:elasticsearch-hadoop`: affected `<7.17.11 || >=8.0.0, <8.9.0`, fixed in `7.17.11`, `8.9.0` · CVSS 6.0 Medium · Not analysed yet · Published 5 Dec 2023 · Tags: Insecure deserialization - [Cross-Site Request Forgery in JFinalCMS via /admin/tag/save](https://agentprime.io/advisories/GHSA-rq2q-hc6h-2px2.md) `GHSA-rq2q-hc6h-2px2`, `CVE-2023-49383` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/div/update](https://agentprime.io/advisories/GHSA-r222-mcff-27ff.md) `GHSA-r222-mcff-27ff`, `CVE-2023-49381` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via admin/nav/delete](https://agentprime.io/advisories/GHSA-pv3g-vc3q-8c9g.md) `GHSA-pv3g-vc3q-8c9g`, `CVE-2023-49448` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/category/delete](https://agentprime.io/advisories/GHSA-mwvq-gc5w-m78f.md) `GHSA-mwvq-gc5w-m78f`, `CVE-2023-49398` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/nav/save](https://agentprime.io/advisories/GHSA-hv4c-v8j8-54cw.md) `GHSA-hv4c-v8j8-54cw`, `CVE-2023-49446` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/category/update](https://agentprime.io/advisories/GHSA-8hch-q86g-j38w.md) `GHSA-8hch-q86g-j38w`, `CVE-2023-49395` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/category/save](https://agentprime.io/advisories/GHSA-882g-gjqp-9vjp.md) `GHSA-882g-gjqp-9vjp`, `CVE-2023-49396` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/div/delete](https://agentprime.io/advisories/GHSA-6v55-h6m5-2352.md) `GHSA-6v55-h6m5-2352`, `CVE-2023-49382` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus](https://agentprime.io/advisories/GHSA-5f56-h6fg-rcrh.md) `GHSA-5f56-h6fg-rcrh`, `CVE-2023-49397` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/nav/update](https://agentprime.io/advisories/GHSA-32j2-c7mx-v4jj.md) `GHSA-32j2-c7mx-v4jj`, `CVE-2023-49447` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS](https://agentprime.io/advisories/GHSA-w492-7g9m-j2ww.md) `GHSA-w492-7g9m-j2ww`, `CVE-2023-49376` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/slide/update](https://agentprime.io/advisories/GHSA-r7w2-j96v-vw8m.md) `GHSA-r7w2-j96v-vw8m`, `CVE-2023-49374` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/tag/update](https://agentprime.io/advisories/GHSA-r6mg-fq87-gw34.md) `GHSA-r6mg-fq87-gw34`, `CVE-2023-49377` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save](https://agentprime.io/advisories/GHSA-r2wj-mxvh-wqfh.md) `GHSA-r2wj-mxvh-wqfh`, `CVE-2023-49379` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/form/save](https://agentprime.io/advisories/GHSA-gw26-cchc-8f2f.md) `GHSA-gw26-cchc-8f2f`, `CVE-2023-49378` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update](https://agentprime.io/advisories/GHSA-gfhv-xxqj-h323.md) `GHSA-gfhv-xxqj-h323`, `CVE-2023-49375` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS](https://agentprime.io/advisories/GHSA-cj7j-23wf-mhrx.md) `GHSA-cj7j-23wf-mhrx`, `CVE-2023-49373` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS](https://agentprime.io/advisories/GHSA-9wvj-wr2f-6mx6.md) `GHSA-9wvj-wr2f-6mx6`, `CVE-2023-49372` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete](https://agentprime.io/advisories/GHSA-765f-3mgx-24pw.md) `GHSA-765f-3mgx-24pw`, `CVE-2023-49380` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability](https://agentprime.io/advisories/GHSA-729q-fcgp-r5xh.md) `GHSA-729q-fcgp-r5xh`, `CVE-2023-41835` · Maven `org.apache.struts:struts2-core`: affected `>=6.2.0, <6.3.0.1 || >=6.0.0, <6.1.2.2 || <2.5.32`, fixed in `6.3.0.1`, `6.1.2.2`, `2.5.32` · CVSS 7.5 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-459 - [HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL](https://agentprime.io/advisories/GHSA-37vq-hr2f-g7h7.md) `GHSA-37vq-hr2f-g7h7`, `CVE-2023-49093` · Maven `org.htmlunit:htmlunit`: affected `<3.9.0`, fixed in `3.9.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2023 · Tags: Code injection - [Solon is vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-vwgg-2q82-38c5.md) `GHSA-vwgg-2q82-38c5`, `CVE-2023-48967` · Maven `org.noear:solon`: affected `<=2.6.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2023 · Tags: Insecure deserialization - [Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download](https://agentprime.io/advisories/GHSA-gqj2-324p-vx73.md) `GHSA-gqj2-324p-vx73`, `CVE-2023-48910` · Maven `io.github.microcks:microcks`: affected `<1.17.1`, fixed in `1.17.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2023 · Tags: Server-side request forgery (SSRF) - [Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data](https://agentprime.io/advisories/GHSA-gm62-rw4g-vrc4.md) `GHSA-gm62-rw4g-vrc4`, `CVE-2023-6481` · Maven `ch.qos.logback:logback-core`: affected `>=1.4.13, <1.4.14 || >=1.3.13, <1.3.14 || >=1.2.12, <1.2.13`, fixed in `1.4.14`, `1.3.14`, `1.2.13` · CVSS 7.1 High · Not analysed yet · Published 4 Dec 2023 - [Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request](https://agentprime.io/advisories/GHSA-6pqx-v9g4-5hc8.md) `GHSA-6pqx-v9g4-5hc8`, `CVE-2023-48887` · Maven `org.jupiter-rpc:jupiter-rpc`: affected `<=1.3.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Dec 2023 · Tags: Code injection, Insecure deserialization - [OpenSearch StackOverflow vulnerability](https://agentprime.io/advisories/GHSA-6g3j-p5g6-992f.md) `GHSA-6g3j-p5g6-992f` · Maven `org.opensearch:opensearch`: affected `<1.3.14 || >=2.0.0, <2.11.1`, fixed in `1.3.14`, `2.11.1` · CVSS 6.5 Medium · Not analysed yet · Published 1 Dec 2023 - [RuoYi vulnerable to SQL injection vulnerability](https://agentprime.io/advisories/GHSA-fg29-37px-c7wm.md) `GHSA-fg29-37px-c7wm`, `CVE-2023-49371` · Maven `com.ruoyi:ruoyi`: affected `<=4.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Dec 2023 · Tags: SQL injection - [Apache Tiles: Unvalidated input may lead to path traversal and XXE](https://agentprime.io/advisories/GHSA-qw4h-3xjj-84cc.md) `GHSA-qw4h-3xjj-84cc`, `CVE-2023-49735` · Maven `org.apache.struts:struts-tiles` and 2 more: affected `>=1.3.0, <=1.3.10`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 1 Dec 2023 · Tags: Path traversal, Denial of service - [Eclipse IDE XXE in eclipse.platform](https://agentprime.io/advisories/GHSA-j24h-xcpc-9jw8.md) `GHSA-j24h-xcpc-9jw8`, `CVE-2023-4218` · Maven `org.eclipse.jdt:org.eclipse.jdt.ui` and 7 more: affected `<3.30.0`, fixed in `3.30.0` · CVSS 5.0 Medium · Not analysed yet · Published 30 Nov 2023 · Tags: XML external entities (XXE) - [Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability](https://agentprime.io/advisories/GHSA-77jg-cpw9-73vg.md) `GHSA-77jg-cpw9-73vg`, `CVE-2023-49733` · Maven `org.apache.cocoon:cocoon`: affected `>=2.2.0, <2.3.0`, fixed in `2.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Nov 2023 · Tags: XML external entities (XXE) - [Apache DolphinScheduler Missing Authorization vulnerability](https://agentprime.io/advisories/GHSA-r44q-98gx-pmh2.md) `GHSA-r44q-98gx-pmh2`, `CVE-2023-49620` · Maven `org.apache.dolphinscheduler:dolphinscheduler-api` and 3 more: affected `<3.1.0`, fixed in `3.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 30 Nov 2023 · Tags: Broken access control - [Apache Cocoon SQL Injection vulnerability](https://agentprime.io/advisories/GHSA-8v4w-jr33-4rh3.md) `GHSA-8v4w-jr33-4rh3`, `CVE-2022-45135` · Maven `org.apache.cocoon:cocoon`: affected `>=2.2.0, <2.3.0`, fixed in `2.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Nov 2023 · Tags: SQL injection - [Keycloak vulnerable to LDAP Injection on UsernameForm Login](https://agentprime.io/advisories/GHSA-8hc5-rmgf-qx6p.md) `GHSA-8hc5-rmgf-qx6p`, `CVE-2022-2232` · Maven `org.keycloak:keycloak-ldap-federation` and 1 more: affected `<23.0.1`, fixed in `23.0.1` · CVSS 7.5 High · Not analysed yet · Published 29 Nov 2023 · Tags: Other injection, CWE-20 - [Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-wpfc-r5qq-7r7p.md) `GHSA-wpfc-r5qq-7r7p`, `CVE-2023-49673` · Maven `io.jenkins.plugins:neuvector-vulnerability-scanner`: affected `<2.2`, fixed in `2.2` · CVSS 4.3 Medium · Not analysed yet · Published 29 Nov 2023 · Tags: Cross-site request forgery (CSRF) - [Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials](https://agentprime.io/advisories/GHSA-qmhq-876f-cr65.md) `GHSA-qmhq-876f-cr65`, `CVE-2023-49653` · Maven `org.jenkins-ci.plugins:jira`: affected `<3.12`, fixed in `3.12` · CVSS 4.3 Medium · Not analysed yet · Published 29 Nov 2023 · Tags: Hard-coded credentials - [Jenkins NeuVector Vulnerability Scanner Plugin missing permission check](https://agentprime.io/advisories/GHSA-ph87-4x2g-6hp4.md) `GHSA-ph87-4x2g-6hp4`, `CVE-2023-49674` · Maven `io.jenkins.plugins:neuvector-vulnerability-scanner`: affected `<2.2`, fixed in `2.2` · CVSS 4.3 Medium · Not analysed yet · Published 29 Nov 2023 · Tags: Broken access control - [Jenkins Google Compute Engine Plugin has incorrect permission checks](https://agentprime.io/advisories/GHSA-pgpj-83g3-mfr2.md) `GHSA-pgpj-83g3-mfr2`, `CVE-2023-49652` · Maven `org.jenkins-ci.plugins:google-compute-engine`: affected `<4.3.17.1 || >=4.5, <4.551.v5a`, fixed in `4.3.17.1`, `4.551.v5a` · CVSS 4.3 Medium · Not analysed yet · Published 29 Nov 2023 · Tags: Broken access control - [Jenkins MATLAB Plugin missing permission checks](https://agentprime.io/advisories/GHSA-cv4x-9f34-8rp9.md) `GHSA-cv4x-9f34-8rp9`, `CVE-2023-49654` · Maven `org.jenkins-ci.plugins:matlab`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 7.1 High · Not analysed yet · Published 29 Nov 2023 · Tags: Broken access control - [Jenkins MATLAB Plugin cross-site request forgery vulnerability](https://agentprime.io/advisories/GHSA-9f5g-rgcr-8grw.md) `GHSA-9f5g-rgcr-8grw`, `CVE-2023-49655` · Maven `org.jenkins-ci.plugins:matlab`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 7.1 High · Not analysed yet · Published 29 Nov 2023 · Tags: Cross-site request forgery (CSRF) - [Jenkins MATLAB Plugin XML External Entity vulnerability](https://agentprime.io/advisories/GHSA-82q9-88m2-4v68.md) `GHSA-82q9-88m2-4v68`, `CVE-2023-49656` · Maven `org.jenkins-ci.plugins:matlab`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 7.1 High · Not analysed yet · Published 29 Nov 2023 · Tags: XML external entities (XXE) - [logback serialization vulnerability](https://agentprime.io/advisories/GHSA-vmq6-5m68-f53m.md) `GHSA-vmq6-5m68-f53m`, `CVE-2023-6378` · Maven `ch.qos.logback:logback-classic` and 1 more: affected `>=1.3.0, <1.3.12 || >=1.4.0, <1.4.12 || <1.2.13`, fixed in `1.3.12`, `1.4.12`, `1.2.13` · CVSS 7.1 High · Not analysed yet · Published 29 Nov 2023 · Tags: Insecure deserialization - [Apache Tomcat Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-fccv-jmmp-qg76.md) `GHSA-fccv-jmmp-qg76`, `BIT-tomcat-2023-46589`, `CVE-2023-46589` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.0-M11 || >=10.1.0-M1, <10.1.16 || >=9.0.0-M1, <9.0.83 || >=8.5.0, <8.5.96`, fixed in `11.0.0-M11`, `10.1.16`, `9.0.83`, `8.5.96` · CVSS 7.5 High · Not analysed yet · Published 28 Nov 2023 · Tags: HTTP request smuggling, CWE-20 - [ureport arbitrary file read vulnerability](https://agentprime.io/advisories/GHSA-9vfc-qxc8-wrpq.md) `GHSA-9vfc-qxc8-wrpq`, `CVE-2023-48848` · Maven `com.bstek.ureport:ureport2-core`: affected `<=2.2.9`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 28 Nov 2023 · Tags: Path traversal - [Apache ActiveMQ Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-53v4-42fg-g287.md) `GHSA-53v4-42fg-g287`, `BIT-activemq-2022-41678`, `CVE-2022-41678` · Maven `org.apache.activemq:apache-activemq`: affected `<5.16.6 || >=5.17.0, <5.17.4`, fixed in `5.16.6`, `5.17.4` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.86 · Not analysed yet · Published 28 Nov 2023 · Tags: Authentication bypass, Insecure deserialization - [Spring Framework vulnerable to denial of service](https://agentprime.io/advisories/GHSA-v94h-hvhg-mf9h.md) `GHSA-v94h-hvhg-mf9h`, `CVE-2023-34053` · Maven `org.springframework:spring-webmvc`: affected `>=6.0.0, <6.0.14`, fixed in `6.0.14` · CVSS 5.3 Medium · Not analysed yet · Published 28 Nov 2023 - [Reactor Netty HTTP Server denial of service vulnerability](https://agentprime.io/advisories/GHSA-q24v-hpg3-v3jp.md) `GHSA-q24v-hpg3-v3jp`, `CVE-2023-34054` · Maven `io.projectreactor.netty:reactor-netty-core`: affected `>=1.1.0, <1.1.13 || >=1.0.0, <1.0.39`, fixed in `1.1.13`, `1.0.39` · CVSS 5.3 Medium · Not analysed yet · Published 28 Nov 2023 - [Spring Boot Actuator denial of service vulnerability](https://agentprime.io/advisories/GHSA-jjfh-589g-3hjx.md) `GHSA-jjfh-589g-3hjx`, `CVE-2023-34055` · Maven `org.springframework.boot:spring-boot-actuator`: affected `<2.7.18 || >=3.0.0, <3.0.13 || >=3.1.0, <3.1.6`, fixed in `2.7.18`, `3.0.13`, `3.1.6` · CVSS 5.3 Medium · Not analysed yet · Published 28 Nov 2023 - [Improper Neutralization of Input in Advanced User Interface for Jolt](https://agentprime.io/advisories/GHSA-68pr-6fjc-wmgm.md) `GHSA-68pr-6fjc-wmgm`, `BIT-nifi-2023-49145`, `CVE-2023-49145` · Maven `org.apache.nifi:nifi-jolt-transform-json-ui`: affected `<1.24.0`, fixed in `1.24.0` · CVSS 7.9 High · Not analysed yet · Published 28 Nov 2023 · Tags: Cross-site scripting (XSS) - [Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year](https://agentprime.io/advisories/GHSA-r68h-jhhj-9jvm.md) `GHSA-r68h-jhhj-9jvm` · Maven `org.owasp.esapi:esapi`: affected `<2.6.0.0`, fixed in `2.6.0.0` · No CVSS score · Not analysed yet · Published 27 Nov 2023 - [Apache DolphinScheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability](https://agentprime.io/advisories/GHSA-c6cg-73p3-973h.md) `GHSA-c6cg-73p3-973h`, `CVE-2023-49068` · Maven `org.apache.dolphinscheduler:dolphinscheduler-api`: affected `<3.2.1`, fixed in `3.2.1` · No CVSS score · Not analysed yet · Published 27 Nov 2023 · Tags: Information disclosure - [Bouncy Castle Denial of Service (DoS)](https://agentprime.io/advisories/GHSA-wjxj-5m7g-mg7q.md) `GHSA-wjxj-5m7g-mg7q`, `CVE-2023-33202` · Maven `org.bouncycastle:bcpkix-jdk18on` and 8 more: affected `<1.73`, fixed in `1.73` · CVSS 5.5 Medium · Not analysed yet · Published 23 Nov 2023 · Tags: Denial of service - [Apache Storm Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files](https://agentprime.io/advisories/GHSA-85p4-q357-72h9.md) `GHSA-85p4-q357-72h9`, `CVE-2023-43123` · Maven `org.apache.storm:storm-core`: affected `>=2.0.0, <2.6.0`, fixed in `2.6.0` · CVSS 5.5 Medium · Not analysed yet · Published 23 Nov 2023 · Tags: Information disclosure - [Directory Traversal in jeecg-boot](https://agentprime.io/advisories/GHSA-rgg9-264h-3hfw.md) `GHSA-rgg9-264h-3hfw`, `CVE-2023-47467` · Maven `org.jeecgframework.boot:jeecg-boot-common`: affected `<=3.6.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 22 Nov 2023 · Tags: Path traversal - [Elasticsearch Improper Handling of Exceptional Conditions](https://agentprime.io/advisories/GHSA-285m-vhfq-xx4h.md) `GHSA-285m-vhfq-xx4h`, `BIT-elasticsearch-2023-46673`, `CVE-2023-46673` · Maven `org.elasticsearch:elasticsearch`: affected `>=7.0.0, <7.17.14 || >=8.0.0, <8.10.3`, fixed in `7.17.14`, `8.10.3` · CVSS 6.5 Medium · Not analysed yet · Published 22 Nov 2023 · Tags: CWE-755 - [APM Java Agent Local Privilege Escalation issue](https://agentprime.io/advisories/GHSA-5xqm-hc45-f2g2.md) `GHSA-5xqm-hc45-f2g2`, `CVE-2021-37942` · Maven `co.elastic.apm:apm-agent-parent` and 1 more: affected `>=1.18.0, <1.27.1`, fixed in `1.27.1` · CVSS 7.0 High · Not analysed yet · Published 22 Nov 2023 · Tags: Privilege escalation Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .