Maven Advisories.

Apache Zeppelin: LDAP search filter query Injection Vulnerability

• Other injection
• CWE-20

>=0.8.2, <0.11.1 · fixed in 0.11.1

Apache Zeppelin vulnerable to cross-site scripting in the helium module

• Cross-site scripting (XSS)
• CWE-116

>=0.8.2, <0.11.1 · fixed in 0.11.1

Apache Zeppelin: Cron arbitrary user impersonation with improper privileges

• Broken access control
• CWE-20

>=0.8.2, <0.11.1 · fixed in 0.11.1

Improper escaping in Apache Zeppelin

• CWE-116

>=0.8.2, <0.11.1 · fixed in 0.11.1

Apache Zeppelin remote code execution by adding malicious JDBC connection string

• Code injection

<0.11.1 · fixed in 0.11.1

google-oauth-java-client improperly verifies cryptographic signature

• Weak cryptography or TLS

>=1.16.0-rc, <1.33.3 · fixed in 1.33.3

Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

• XML external entities (XXE)
• CWE-20

>=0.8.0, <0.11.0 · fixed in 0.11.0

Apache Zeppelin: Replacing other users notebook, bypassing any permissions

• Authentication bypass

>=0.10.1, <0.11.0 · fixed in 0.11.0

Eclipse Kura LogServlet vulnerability

• Authentication bypass

>=2.0.600, <=2.4.0 · no fixed version yet

Apache Zeppelin: Denial of service with invalid notebook name

• CWE-20

>=0.10.1, <0.11.0 · fixed in 0.11.0

Apache Zeppelin CSRF vulnerability in the Credentials page

• Cross-site request forgery (CSRF)

<=0.9.0 · no fixed version yet

Apache Zeppelin Path Traversal vulnerability

• Path traversal
• CWE-20

>=0.9.0, <0.11.0 · fixed in 0.11.0

WildFly Elytron: SSRF security issue

• Server-side request forgery (SSRF)

<=2.4.0.CR1 · no fixed version yet

Xuxueli xxl-job template injection vulnerability

• Other injection
• Insecure deserialization

<=2.4.0 · no fixed version yet

quarkus-core leaks local environment variables from Quarkus namespace during application's build

• CWE-526

>=3.9.0.CR1, <3.9.2 || >=3.3.0.CR1, <3.8.4 || <3.2.12.Final · fixed in 3.9.2, 3.8.4, 3.2.12.Final

Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints

• Broken access control

>=2.7.1, <=2.10.6 || >=2.11.0, <=2.11.4 || >=3.0.0, <3.0.4 || >=3.1.0, <=3.1.3 || >=3.2.0, <3.2.2 · fixed in 3.0.4, 3.2.2

Eclipse Vert.x vulnerable to a memory leak in TCP servers

• Denial of service

>=4.3.4, <4.4.8 || >=4.5.0, <4.5.3 · fixed in 4.4.8, 4.5.3

Withdrawn: JJWT improperly generates signing keys

• Weak cryptography or TLS

<=0.12.5 · no fixed version yet

Bonita cross-site scripting vulnerability

• Cross-site scripting (XSS)

<10.1.0.W11 · fixed in 10.1.0.W11

Elasticsearch Uncaught Exception leading to crash

• CWE-248

>=8.4.0, <8.11.1 · fixed in 8.11.1

Elasticsearch Incorrect Authorization vulnerability

• Broken access control

>=8.10.0, <8.13.0 · fixed in 8.13.0

Elasticsearch Uncontrolled Resource Consumption vulnerability

• Denial of service

>=7.0.0, <7.17.19 || >=8.0.0, <8.13.0 · fixed in 7.17.19, 8.13.0

Eclipse Vert.x memory leak

• Memory corruption
• Information disclosure

>=4.5.0, <4.5.2 || >=4.4.5, <4.4.7 · fixed in 4.5.2, 4.4.7

Ignite Realtime Openfire privilege escalation vulnerability

• Privilege escalation
• Broken access control

<4.8.1 · fixed in 4.8.1

Ignite Realtime Openfire privilege escalation vulnerability

• Broken access control
• CWE-273

<4.8.1 · fixed in 4.8.1

Netty's HttpPostRequestDecoder can OOM

• Denial of service

<4.1.108.Final · fixed in 4.1.108.Final

XNIO denial of service vulnerability

• Denial of service

<3.8.14.Final · fixed in 3.8.14.Final

Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

• Memory corruption

>=2.0, <2.10.1 · fixed in 2.10.1

Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

• Memory corruption

>=2.0, <2.10.1 · fixed in 2.10.1

SQL injection in Folio Spring Module Core

• SQL injection

<2.0.0 · fixed in 2.0.0

Improper Authentication in Spring Authorization Server

• Authentication bypass
• Code injection

<1.1.6 || >=1.2.0, <1.2.3 · fixed in 1.1.6, 1.2.3

GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

>=2.24.0, <2.24.1 || <2.23.4 · fixed in 2.24.1, 2.23.4

GeoServer's MapML HTML Page vulnerable to Stored Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

<2.23.4 || >=2.24.0, <2.24.1 · fixed in 2.23.4, 2.24.1

GeoServer's WMS OpenLayers Format vulnerable to Stored Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

<2.23.3 || >=2.24.0, <2.24.1 · fixed in 2.23.3, 2.24.1

GeoServer's GWC Seed Form vulnerable to Stored Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

<2.23.2 || >=2.24.0, <2.24.1 · fixed in 2.23.2, 2.24.1

GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

<2.23.4 || >=2.24.0, <2.24.1 · fixed in 2.23.4, 2.24.1

GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

<2.23.3 · fixed in 2.23.3

GeoServer Arbitrary file renaming vulnerability in REST Coverage/Data Store API

• Path traversal
• CWE-20

<2.23.5 || >=2.24.0, <2.24.2 · fixed in 2.23.5, 2.24.2

Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API

• Cross-site scripting (XSS)

<2.23.3 · fixed in 2.23.3

Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API

• Unrestricted file upload
• CWE-20

<2.23.4 || >=2.24.0, <2.24.1 · fixed in 2.23.4, 2.24.1

GeoServer log file path traversal vulnerability

• Path traversal

<=2.23.4 · no fixed version yet

Cross-Site Request Forgery in Apache Wicket

• Cross-site request forgery (CSRF)
• HTTP request smuggling

>=9.1.0, <9.17.0 || >=10.0.0-M1, <10.0.0 · fixed in 9.17.0, 10.0.0

Improper Input Validation vulnerability in Apache Hop Engine

• CWE-20

<2.8.0 · fixed in 2.8.0

Path traversal in flaskcode Devan-Kerman ARRP

• Path traversal

<0.8.2 · fixed in 0.8.2

Erroneous authentication pass in Spring Security

• Authentication bypass
• Broken access control

<5.7.12 || >=5.8.0, <5.8.11 || >=6.0.0, <6.1.8 || >=6.2.0, <6.2.3 · fixed in 5.7.12, 5.8.11, 6.1.8, 6.2.3

FitNesse Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<20220319 · fixed in 20220319

FitNesse allows execution of arbitrary OS commands

• Command injection

<=20240707 · no fixed version yet

Spring Framework URL Parsing with Host Validation Vulnerability

• Open redirect

>=6.1.0, <6.1.5 || >=6.0.0, <6.0.18 || <5.3.33 · fixed in 6.1.5, 6.0.18, 5.3.33

Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling

• Information disclosure
• Broken access control

>=3.8.0, <3.8.4 || >=3.9.0, <3.9.2 || >=3.6.0, <=3.7.2 · fixed in 3.8.4, 3.9.2

SSRF vulnerability using the Aegis DataBinding in Apache CXF

• Server-side request forgery (SSRF)

<3.5.8 || >=3.6.0, <3.6.3 || >=4.0.0, <4.0.4 · fixed in 3.5.8, 3.6.3, 4.0.4

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat

• CWE-459

>=11.0.0-M1, <11.0.0-M17 || >=10.1.0-M1, <10.1.19 || >=9.0.0-M1, <9.0.86 || >=8.5.0, <8.5.99 · fixed in 11.0.0-M17, 10.1.19, 9.0.86, 8.5.99

Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests

• CWE-20

>=8.5.0, <8.5.99 || >=9.0.0-M1, <9.0.86 || >=10.1.0-M1, <10.1.19 || >=11.0.0-M1, <11.0.0-M17 · fixed in 8.5.99, 9.0.86, 10.1.19, 11.0.0-M17

In Quarkus, git credentials could be inadvertently published

• Information disclosure

<3.7.3 · fixed in 3.7.3

Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution

• CWE-20
• CWE-913

>=2.4.0, <2.10.6 || >=2.11.0, <2.11.4 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 || >=3.2.0, <3.2.1 · fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1

Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

• Path traversal

>=2.4.0, <2.10.6 || >=2.11.0, <2.11.4 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 || >=3.2.0, <3.2.1 · fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1

Apache Pulsar: Improper Authorization For Topic-Level Policy Management

• Broken access control

>=3.2.0, <3.2.1 || >=3.1.0, <3.1.3 || >=3.0.0, <3.0.3 || >=2.11.0, <2.11.4 || >=2.7.1, <2.10.6 · fixed in 3.2.1, 3.1.3, 3.0.3, 2.11.4, 2.10.6

Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint

• Authentication bypass

>=2.6.0, <2.10.6 || >=2.11.0, <2.11.3 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.1 · fixed in 2.10.6, 2.11.3, 3.0.2, 3.1.1

Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying

• Information disclosure
• CWE-20

>=2.4.0, <2.10.6 || >=2.11.0, <2.11.4 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 || >=3.2.0, <3.2.1 · fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1

nGrinder vulnerable to unsafe Java objects deserialization

• Insecure deserialization

<3.5.9 · fixed in 3.5.9

Jenkins Delphix Plugin has SSL/TLS certificate validation disabled by default

• Weak cryptography or TLS

>=3.0.1, <3.0.2 · fixed in 3.0.2