# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted](https://agentprime.io/advisories/GHSA-mpwq-j3xf-7m5w.md)
  `GHSA-mpwq-j3xf-7m5w`, `CVE-2023-6291` · Maven `org.keycloak:keycloak-services`: affected `<23.0.3`, fixed in `23.0.3` · CVSS 7.1 High · Not analysed yet · Published 21 Dec 2023 · Tags: Open redirect, CWE-20
- [Apache IoTDB: Unsafe deserialize map in Sync Tool](https://agentprime.io/advisories/GHSA-f23h-52hj-99p6.md)
  `GHSA-f23h-52hj-99p6`, `CVE-2023-51656` · Maven `org.apache.iotdb:iotdb-parent`: affected `>=0.13.0, <1.2.2`, fixed in `1.2.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Dec 2023 · Tags: Insecure deserialization
- [Grails data binding causes JVM crash and/or other denial of service](https://agentprime.io/advisories/GHSA-3pjv-r7w4-2cf5.md)
  `GHSA-3pjv-r7w4-2cf5`, `CVE-2023-46131` · Maven `org.grails:grails-databinding`: affected `>=6.0.0, <6.1.0 || >=5.0.0, <5.3.4 || >=4.0.0, <4.1.3 || >=2.0.0, <3.3.17`, fixed in `6.1.0`, `5.3.4`, `4.1.3`, `3.3.17` · CVSS 6.5 Medium · Not analysed yet · Published 20 Dec 2023 · Tags: Denial of service
- [Apache Pulsar WebSocket Proxy contains an Improper Authentication vulnerability](https://agentprime.io/advisories/GHSA-83q5-whqp-r8jr.md)
  `GHSA-83q5-whqp-r8jr`, `CVE-2023-37544` · Maven `org.apache.pulsar:pulsar-websocket`: affected `<2.10.5 || >=2.11.0, <2.11.2 || >=3.0.0, <3.0.1`, fixed in `2.10.5`, `2.11.2`, `3.0.1` · CVSS 7.5 High · Not analysed yet · Published 20 Dec 2023 · Tags: Authentication bypass
- [Velocity execution without script right through tree macro](https://agentprime.io/advisories/GHSA-p5f8-qf24-24cj.md)
  `GHSA-p5f8-qf24-24cj`, `CVE-2023-50732` · Maven `org.xwiki.platform:xwiki-platform-index-tree-macro`: affected `>=8.3-rc-1, <14.10.7 || >=15.0-rc-1, <15.2-rc-1`, fixed in `14.10.7`, `15.2-rc-1` · CVSS 8.3 High · Not analysed yet · Published 19 Dec 2023 · Tags: Broken access control
- [Duplicate Advisory: Keycloak Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-3p75-q5cc-qmj7.md)
  `GHSA-3p75-q5cc-qmj7` · Maven `org.keycloak:keycloak-parent`: affected `<=23.0.3`, no fixed version yet · CVSS 4.6 Medium · Withdrawn · Not analysed yet · Published 19 Dec 2023 · Tags: Open redirect
- [Grackle has StackOverflowError in GraphQL query processing](https://agentprime.io/advisories/GHSA-g56x-7j6w-g8r8.md)
  `GHSA-g56x-7j6w-g8r8`, `CVE-2023-50730` · Maven `edu.gemini:gsp-graphql-core_2.13` and 11 more: affected `<=0.14.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2023 · Tags: Denial of service
- [Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri](https://agentprime.io/advisories/GHSA-cvg2-7c3j-g36j.md)
  `GHSA-cvg2-7c3j-g36j`, `CVE-2023-6134` · Maven `org.keycloak:keycloak-services`: affected `<23.0.3`, fixed in `23.0.3` · CVSS 4.6 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS), CWE-75
- [Xnx3 Wangmarket Cross-Site Scripting vulnerability](https://agentprime.io/advisories/GHSA-3x3w-849q-423v.md)
  `GHSA-3x3w-849q-423v`, `CVE-2023-6886` · Maven `com.xnx3.wangmarket:wangmarket`: affected `<=6.1.0`, no fixed version yet · CVSS 4.7 Medium · Not analysed yet · Published 17 Dec 2023 · Tags: Cross-site scripting (XSS), Code injection
- [Remote code execution/programming rights with configuration section from any user account](https://agentprime.io/advisories/GHSA-qj86-p74r-7wp5.md)
  `GHSA-qj86-p74r-7wp5`, `CVE-2023-50723` · Maven `org.xwiki.platform:xwiki-platform-administration-ui`: affected `>=2.3, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1`, fixed in `14.10.15`, `15.5.2`, `15.7-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2023 · Tags: Code injection
- [XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass](https://agentprime.io/advisories/GHSA-cp3j-273x-3jxc.md)
  `GHSA-cp3j-273x-3jxc`, `CVE-2023-50722` · Maven `org.xwiki.platform:xwiki-platform-administration-ui`: affected `>=2.3, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1`, fixed in `14.10.15`, `15.5.2`, `15.7-rc-1` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2023 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF)
- [Remote code execution from account through SearchAdmin](https://agentprime.io/advisories/GHSA-7654-vfh6-rw6x.md)
  `GHSA-7654-vfh6-rw6x`, `CVE-2023-50721` · Maven `org.xwiki.platform:xwiki-platform-search-ui`: affected `>=4.5-rc-1, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1`, fixed in `14.10.15`, `15.5.2`, `15.7-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.79 · Not analysed yet · Published 16 Dec 2023 · Tags: Code injection
- [Solr search discloses email addresses of users](https://agentprime.io/advisories/GHSA-2grh-gr37-2283.md)
  `GHSA-2grh-gr37-2283`, `CVE-2023-50720` · Maven `org.xwiki.platform:xwiki-platform-search-solr-api`: affected `<14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1`, fixed in `14.10.15`, `15.5.2`, `15.7-rc-1` · CVSS 5.3 Medium · EPSS 0.59 · Not analysed yet · Published 16 Dec 2023 · Tags: Information disclosure
- [Solr search discloses password hashes of all users](https://agentprime.io/advisories/GHSA-p6cp-6r35-32mh.md)
  `GHSA-p6cp-6r35-32mh`, `CVE-2023-50719` · Maven `org.xwiki.platform:xwiki-platform-search-solr-api`: affected `>=7.2-milestone-2, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1`, fixed in `14.10.15`, `15.5.2`, `15.7-rc-1` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.84 · Not analysed yet · Published 16 Dec 2023 · Tags: Information disclosure
- [Apache StreamPark: Authenticated system users could trigger SQL injection vulnerability](https://agentprime.io/advisories/GHSA-rrcg-jwr5-32g7.md)
  `GHSA-rrcg-jwr5-32g7`, `CVE-2023-30867` · Maven `org.apache.streampark:streampark`: affected `>=2.0.0, <2.1.2`, fixed in `2.1.2` · CVSS 4.9 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: SQL injection
- [Apache StreamPark: Authenticated system users could trigger remote command execution](https://agentprime.io/advisories/GHSA-qg44-xqwj-wc28.md)
  `GHSA-qg44-xqwj-wc28`, `CVE-2023-49898` · Maven `org.apache.streampark:streampark`: affected `>=2.0.0, <2.1.2`, fixed in `2.1.2` · No CVSS score · Not analysed yet · Published 15 Dec 2023 · Tags: Command injection
- [WSO2 API Manager allows attackers to change the API rating](https://agentprime.io/advisories/GHSA-w7rx-824v-rgx5.md)
  `GHSA-w7rx-824v-rgx5`, `CVE-2023-6835` · Maven `org.wso2.carbon.apimgt:forum`: affected `<=9.0.78`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: CWE-20
- [Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning](https://agentprime.io/advisories/GHSA-f6jm-9pr8-9c3w.md)
  `GHSA-f6jm-9pr8-9c3w`, `CVE-2023-6837` · Maven `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework` and 1 more: affected `<5.20.254`, fixed in `5.20.254` · CVSS 8.5 High · Not analysed yet · Published 15 Dec 2023 · Tags: Broken access control
- [WSO2 products vulnerable to XML External Entity attack](https://agentprime.io/advisories/GHSA-cr8h-fr86-8vfv.md)
  `GHSA-cr8h-fr86-8vfv`, `CVE-2023-6836` · Maven `org.wso2.am:wso2am` and 5 more: affected `<4.0.0-beta`, fixed in `4.0.0-beta` · CVSS 4.6 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: XML external entities (XXE)
- [Apache Dubbo: Bypass deny serialize list check in Apache Dubbo](https://agentprime.io/advisories/GHSA-97rv-88gf-phvr.md)
  `GHSA-97rv-88gf-phvr`, `CVE-2023-46279` · Maven `org.apache.dubbo:dubbo`: affected `>=3.1.5, <3.1.6`, fixed in `3.1.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2023 · Tags: Insecure deserialization
- [Bypass serialize checks in Apache Dubbo](https://agentprime.io/advisories/GHSA-6x49-w35h-wqrj.md)
  `GHSA-6x49-w35h-wqrj`, `CVE-2023-29234` · Maven `org.apache.dubbo:dubbo`: affected `>=3.1.0, <3.1.11 || >=3.2.0, <3.2.5`, fixed in `3.1.11`, `3.2.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2023 · Tags: Insecure deserialization
- [Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri](https://agentprime.io/advisories/GHSA-5968-qw33-h47j.md)
  `GHSA-5968-qw33-h47j` · Maven `org.keycloak:keycloak-services`: affected `<23.0.3`, fixed in `23.0.3` · CVSS 4.6 Medium · Withdrawn · Not analysed yet · Published 15 Dec 2023 · Tags: CWE-75
- [Allocation of Resources Without Limits in Keycloak](https://agentprime.io/advisories/GHSA-54f3-c6hg-865h.md)
  `GHSA-54f3-c6hg-865h`, `CVE-2023-6563` · Maven `org.keycloak:keycloak-model-jpa`: affected `<21.0.0`, fixed in `21.0.0` · CVSS 7.7 High · Not analysed yet · Published 14 Dec 2023 · Tags: Denial of service
- [Cross-site Scripting in JFinalcms](https://agentprime.io/advisories/GHSA-xv7p-jw46-8r85.md)
  `GHSA-xv7p-jw46-8r85`, `CVE-2023-50137` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in JFinalcms](https://agentprime.io/advisories/GHSA-p3ph-6245-4wfc.md)
  `GHSA-p3ph-6245-4wfc`, `CVE-2023-50102` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in JFinalcms](https://agentprime.io/advisories/GHSA-m3p6-43xj-pf9v.md)
  `GHSA-m3p6-43xj-pf9v`, `CVE-2023-50101` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in JFinalcms](https://agentprime.io/advisories/GHSA-3hf6-f8ch-5869.md)
  `GHSA-3hf6-f8ch-5869`, `CVE-2023-50100` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Open redirect in Apache Shiro](https://agentprime.io/advisories/GHSA-hhw5-c326-822h.md)
  `GHSA-hhw5-c326-822h`, `CVE-2023-46750` · Maven `org.apache.shiro:shiro-web`: affected `<1.13.0 || >=2.0.0-alpha-1, <2.0.0-alpha-4`, fixed in `1.13.0`, `2.0.0-alpha-4` · CVSS 6.1 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: Open redirect
- [Arbitrary file deletion vulnerability in Jenkins Scriptler Plugin](https://agentprime.io/advisories/GHSA-xcrr-x93h-rv4v.md)
  `GHSA-xcrr-x93h-rv4v`, `CVE-2023-50764` · Maven `org.jenkins-ci.plugins:scriptler`: affected `<=342.v6a`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 13 Dec 2023
- [Tokens stored in plain text by Dingding JSON Pusher Plugin](https://agentprime.io/advisories/GHSA-wjr6-v4c7-8cv6.md)
  `GHSA-wjr6-v4c7-8cv6`, `CVE-2023-50772` · Maven `com.zintow:dingding-json-pusher`: affected `<=2.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure
- [Tokens stored in plain text by PaaSLane Estimate Plugin](https://agentprime.io/advisories/GHSA-v9w3-34xq-hrjg.md)
  `GHSA-v9w3-34xq-hrjg`, `CVE-2023-50777` · Maven `com.cloudtp.jenkins:paaslane-estimate`: affected `<=1.0.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure, Broken access control
- [Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin](https://agentprime.io/advisories/GHSA-v672-5x3h-57qp.md)
  `GHSA-v672-5x3h-57qp`, `CVE-2023-50775` · Maven `org.jenkins-ci.plugins:ec2-deployment-dashboard`: affected `<=1.0.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site request forgery (CSRF)
- [Displayed in plain text by Dingding JSON Pusher Plugin](https://agentprime.io/advisories/GHSA-q5cj-xf99-79m8.md)
  `GHSA-q5cj-xf99-79m8`, `CVE-2023-50773` · Maven `com.zintow:dingding-json-pusher`: affected `<=2.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure
- [Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-phjq-7xqp-2526.md)
  `GHSA-phjq-7xqp-2526`, `CVE-2023-50768` · Maven `org.sonatype.nexus.ci:nexus-jenkins-plugin`: affected `<3.18.1-01`, fixed in `3.18.1-01` · CVSS 4.2 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site request forgery (CSRF)
- [Missing permission check in Jenkins PaaSLane Estimate Plugin](https://agentprime.io/advisories/GHSA-jqr2-7f24-xrgc.md)
  `GHSA-jqr2-7f24-xrgc`, `CVE-2023-50779` · Maven `com.cloudtp.jenkins:paaslane-estimate`: affected `<=1.0.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Cross-Site Request Forgery in Jenkins PaaSLane Estimate Plugin](https://agentprime.io/advisories/GHSA-g4xm-5mqm-8m32.md)
  `GHSA-g4xm-5mqm-8m32`, `CVE-2023-50778` · Maven `com.cloudtp.jenkins:paaslane-estimate`: affected `<=1.0.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site request forgery (CSRF)
- [Tokens stored in plain text by PaaSLane Estimate Plugin](https://agentprime.io/advisories/GHSA-c2f6-rf2r-6j6f.md)
  `GHSA-c2f6-rf2r-6j6f`, `CVE-2023-50776` · Maven `com.cloudtp.jenkins:paaslane-estimate`: affected `<=1.0.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure
- [Jenkins Nexus Platform Plugin missing permission check](https://agentprime.io/advisories/GHSA-9vrm-747r-668v.md)
  `GHSA-9vrm-747r-668v`, `CVE-2023-50767` · Maven `org.sonatype.nexus.ci:nexus-jenkins-plugin`: affected `<3.18.1-01`, fixed in `3.18.1-01` · CVSS 7.1 High · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin](https://agentprime.io/advisories/GHSA-9qv8-7jfq-73j2.md)
  `GHSA-9qv8-7jfq-73j2`, `CVE-2023-50771` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<3.0`, fixed in `3.0` · CVSS 6.1 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Open redirect
- [Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin](https://agentprime.io/advisories/GHSA-7ccg-jm7j-4f8v.md)
  `GHSA-7ccg-jm7j-4f8v`, `CVE-2023-50774` · Maven `org.jenkins-ci.plugins:htmlresource`: affected `<=1.02`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site request forgery (CSRF)
- [Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin](https://agentprime.io/advisories/GHSA-6r5w-jjr5-qvgr.md)
  `GHSA-6r5w-jjr5-qvgr`, `CVE-2023-50770` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<4.229.vf736b`, fixed in `4.229.vf736b` · CVSS 6.7 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure, Hard-coded credentials
- [Missing permission check in Jenkins Scriptler Plugin](https://agentprime.io/advisories/GHSA-4j42-6xfx-h754.md)
  `GHSA-4j42-6xfx-h754`, `CVE-2023-50765` · Maven `org.jenkins-ci.plugins:scriptler`: affected `<=342.v6a`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-4gfc-72gw-v385.md)
  `GHSA-4gfc-72gw-v385`, `CVE-2023-50766` · Maven `org.sonatype.nexus.ci:nexus-jenkins-plugin`: affected `<3.18.1-01`, fixed in `3.18.1-01` · CVSS 7.1 High · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Nexus Platform Plugin missing permission check](https://agentprime.io/advisories/GHSA-4g5f-w3mh-w99m.md)
  `GHSA-4g5f-w3mh-w99m`, `CVE-2023-50769` · Maven `org.sonatype.nexus.ci:nexus-jenkins-plugin`: affected `<3.18.1-01`, fixed in `3.18.1-01` · CVSS 4.2 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Cross-site Scripting in silverpeas](https://agentprime.io/advisories/GHSA-wgrw-fj3v-fhc5.md)
  `GHSA-wgrw-fj3v-fhc5`, `CVE-2023-47324` · Maven `org.silverpeas.core:silverpeas-core-api` and 3 more: affected `<6.3.2`, fixed in `6.3.2` · CVSS 5.4 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Broken access control in Silverpeas](https://agentprime.io/advisories/GHSA-vpp3-hpcm-v944.md)
  `GHSA-vpp3-hpcm-v944`, `CVE-2023-47327` · Maven `org.silverpeas.core:silverpeas-core-web`: affected `<6.3.2`, fixed in `6.3.2` · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Cross Site Request Forgery in Silverpeas](https://agentprime.io/advisories/GHSA-gqgv-7wpj-vm6q.md)
  `GHSA-gqgv-7wpj-vm6q`, `CVE-2023-47326` · Maven `org.silverpeas.core:silverpeas-core`: affected `<6.3.2`, fixed in `6.3.2` · CVSS 8.8 High · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site request forgery (CSRF)
- [Cross Site Request Forgery in Silverpeas](https://agentprime.io/advisories/GHSA-g27c-w2v7-88xp.md)
  `GHSA-g27c-w2v7-88xp`, `CVE-2023-47322` · Maven `org.silverpeas.core:silverpeas-core-web`: affected `<6.3.2`, fixed in `6.3.2` · CVSS 8.8 High · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF)
- [Missing access control in Silverpeas](https://agentprime.io/advisories/GHSA-cwh6-hm53-6w2m.md)
  `GHSA-cwh6-hm53-6w2m`, `CVE-2023-47323` · Maven `org.silverpeas.core:silverpeas-core-api` and 1 more: affected `<6.3.2`, fixed in `6.3.2` · CVSS 7.5 High · Not analysed yet · Published 13 Dec 2023
- [Broken access control in Silverpeas](https://agentprime.io/advisories/GHSA-42g3-3jwm-63rx.md)
  `GHSA-42g3-3jwm-63rx`, `CVE-2023-47325` · Maven `org.silverpeas.core:silverpeas-core-web`: affected `<6.3.2`, fixed in `6.3.2` · CVSS 5.4 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Broken access control in Silverpeas](https://agentprime.io/advisories/GHSA-28wg-8gv4-mpjf.md)
  `GHSA-28wg-8gv4-mpjf`, `CVE-2023-47321` · Maven `org.silverpeas.core:silverpeas-core-web`: affected `<6.3.2`, fixed in `6.3.2` · CVSS 4.9 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Broken access control in Silverpeas](https://agentprime.io/advisories/GHSA-whgv-6j78-5rh2.md)
  `GHSA-whgv-6j78-5rh2`, `CVE-2023-47320` · Maven `org.silverpeas.core:silverpeas-core-war` and 1 more: affected `<6.3.2`, fixed in `6.3.2` · CVSS 8.1 High · Not analysed yet · Published 13 Dec 2023 · Tags: Broken access control
- [Improper JWT Signature Validation in SAP Security Services Library](https://agentprime.io/advisories/GHSA-59c9-pxq8-9c73.md)
  `GHSA-59c9-pxq8-9c73`, `CVE-2023-50422`, `CVE-2023-50424`, `GHSA-92cg-ghq6-9587`, `GHSA-m8rw-rcpq-2vp2`, `GO-2023-2400` · Maven `com.sap.cloud.security:java-security` and 2 more: affected `<2.17.0 || >=3.0.0, <3.3.0`, fixed in `2.17.0`, `3.3.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Dec 2023 · Tags: Privilege escalation, CWE-749
- [Alkacon OpenCMS XSS via Mercury template](https://agentprime.io/advisories/GHSA-w62v-q77r-66cc.md)
  `GHSA-w62v-q77r-66cc`, `CVE-2023-6379` · Maven `org.opencms:opencms-core`: affected `>=14.0.0, <16.0.0`, fixed in `16.0.0` · CVSS 5.4 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library](https://agentprime.io/advisories/GHSA-gcgw-q47m-prvj.md)
  `GHSA-gcgw-q47m-prvj` · Maven `com.sap.cloud.security:java-security` and 2 more: affected `<2.17.0 || >=3.0.0, <3.3.0`, fixed in `2.17.0`, `3.3.0` · CVSS 9.1 Critical · Withdrawn · Not analysed yet · Published 12 Dec 2023 · Tags: Privilege escalation, Broken access control, CWE-749
- [Directory Traversal in JFinalCMS](https://agentprime.io/advisories/GHSA-7x2g-4jvc-4x6p.md)
  `GHSA-7x2g-4jvc-4x6p`, `CVE-2023-50449` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 10 Dec 2023 · Tags: Path traversal
- [Authorization bypass in Quarkus](https://agentprime.io/advisories/GHSA-mvc8-6ffp-jrx5.md)
  `GHSA-mvc8-6ffp-jrx5`, `CVE-2023-6394` · Maven `io.quarkus:quarkus-smallrye-graphql-client`: affected `>=2.14.0, <3.5.3 || <2.13.9.Final`, fixed in `3.5.3`, `2.13.9.Final` · CVSS 7.4 High · Not analysed yet · Published 9 Dec 2023 · Tags: Broken access control, CWE-551, CWE-696
- [Cross-site Scripting in JFinalCMS](https://agentprime.io/advisories/GHSA-m42v-qv3c-h6j7.md)
  `GHSA-m42v-qv3c-h6j7`, `CVE-2023-49487` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 8 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in JFinalCMS](https://agentprime.io/advisories/GHSA-hjfp-2j7q-xmx4.md)
  `GHSA-hjfp-2j7q-xmx4`, `CVE-2023-49486` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 8 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in JFinalCMS](https://agentprime.io/advisories/GHSA-f2w8-4m48-5qrq.md)
  `GHSA-f2w8-4m48-5qrq`, `CVE-2023-49485` · Maven `com.jfinal:jfinal`: affected `<=5.0.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 8 Dec 2023 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDIzLTEyLTA4VDE1OjMwOjE5LjAwMDAwMFoiLCJHSFNBLWYydzgtNG00OC01cXJxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDIzLTEyLTIyVDE4OjMwOjMwLjAwMDAwMFoiLCJHSFNBLXJmcTMtd3BqaC1wcHZnIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDIzLTEyLTIyVDE4OjMwOjMwLjAwMDAwMFoiLCJHSFNBLXJmcTMtd3BqaC1wcHZnIl0>. Everything for agents: <https://agentprime.io/llms.txt>.