Maven Advisories.

veraPDF has potential XSLT injection vulnerability when using policy files

• Other injection

<1.24.2 · fixed in 1.24.2

Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability

• Broken access control

<10.1.0.W11 · fixed in 10.1.0.W11

Amazon JDBC Driver for Redshift SQL Injection via line comment generation

• SQL injection

<2.1.0.28 · fixed in 2.1.0.28

Ant Media Server does not properly authorize non-administrative API calls

• CWE-302

<=2.9.0 · no fixed version yet

Apache Karaf Cave: Cave SSRF and arbitrary file access

• Server-side request forgery (SSRF)
• CWE-20

<=4.1.2 · no fixed version yet

Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

• Information disclosure

<1.78 · fixed in 1.78

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

• Denial of service

>=1.73, <1.78 · fixed in 1.78

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

• Memory corruption
• Denial of service

<1.0.2.5 · fixed in 1.0.2.5

Genie Path Traversal vulnerability via File Uploads

• Path traversal

<4.3.18 · fixed in 4.3.18

Apache Inlong Deserialization of Untrusted Data vulnerability

• Insecure deserialization

>=1.7.0, <1.12.0 · fixed in 1.12.0

Neo4j Cypher component mishandles IMMUTABLE privileges

• Privilege escalation
• CWE-471

>=5.0.0, <5.19.0 · fixed in 5.19.0

MS Basic Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<=2.1.13.4 · no fixed version yet

Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure

• Information disclosure
• Hard-coded credentials

>=0.2.1, <0.6.3 · fixed in 0.6.3

Bouncy Castle Java Cryptography API vulnerable to DNS poisoning

• Weak cryptography or TLS

>=1.61, <1.78 · fixed in 1.78

Apache Hive Code Injection vulnerability

• Code injection

>=4.0.0-alpha-1, <4.0.0 · fixed in 4.0.0

Jenkins Git server Plugin does not perform a permission check

• Privilege escalation
• Broken access control

<117.veb · fixed in 117.veb

Wildfly vulnerable to denial of service

• Denial of service

<=24.0.0.Final · no fixed version yet

Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

• CWE-693

<1336.vf33a · fixed in 1336.vf33a

Jenkins Subversion Partial Release Manager Plugin programmatically disables the fix for CVE-2016-3721

• Prototype pollution

<=1.0.1 · no fixed version yet

Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext

• Hard-coded credentials

<=1.4.0 · no fixed version yet

Jenkins Script Security Plugin sandbox bypass vulnerability

• Authentication bypass

<1336.vf33a · fixed in 1336.vf33a

Apache ActiveMQ's default configuration doesn't secure the API web context

• CWE-1188

>=6.0.0, <6.1.2 · fixed in 6.1.2

XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets

• CWE-669

<2.10.0 · fixed in 2.10.0

Quarkus: security checks in resteasy reactive may trigger a denial of service

• CWE-281

>=3.8.0.CR1, <3.8.0 || >=3.3.0.CR1, <3.7.4 || <3.2.11.Final · fixed in 3.8.0, 3.7.4, 3.2.11.Final

Jberet: jberet-core logging database credentials

• Information disclosure
• CWE-523

<2.2.1.Final · fixed in 2.2.1.Final

Quarkus: authorization flaw in quarkus resteasy reactive and classic

• Broken access control
• Authentication bypass

<3.2.10.Final || >=3.3.0, <3.6.9 || >=3.7.0, <3.7.1 · fixed in 3.2.10.Final, 3.6.9, 3.7.1

OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)

• Code injection

<1.2.4 · fixed in 1.2.4

OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)

• Code injection

<1.2.4 · fixed in 1.2.4

OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)

• Code injection

<1.3.1 · fixed in 1.3.1

JADX file override vulnerability

• Path traversal

<1.5.0 · fixed in 1.5.0

Ant Media Server vulnerable to a local privilege escalation

• Broken access control

>=2.6.0, <2.9.0 · fixed in 2.9.0

Apache HugeGraph-Hubble: SSRF in Hubble connection page

• Server-side request forgery (SSRF)

>=1.0.0, <1.3.0 · fixed in 1.3.0

Apache HugeGraph-Server: Bypass whitelist in Auth mode

• Authentication bypass

>=1.0.0, <1.3.0 · fixed in 1.3.0

Apache HugeGraph-Server: Command execution in gremlin

• Command injection
• Broken access control

>=1.0.0, <1.3.0 · fixed in 1.3.0

Keycloak vulnerable to impersonation via logout token exchange

• Broken access control
• Authentication bypass

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Keycloak vulnerable to session hijacking via re-authentication

• Authentication bypass

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Keycloak path traversal vulnerability in redirection validation

• Path traversal

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

• CWE-346

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

• Other injection

<22.0.9 || >=23.0.0, <23.0.5 · fixed in 22.0.9, 23.0.5

Keycloak Authorization Bypass vulnerability

• CWE-625

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow

• Cross-site scripting (XSS)
• Open redirect

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Keycloak secondary factor bypass in step-up authentication

• Authentication bypass

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Keycloak path traversal vulnerability in the redirect validation

• Open redirect
• CWE-346

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

BlazeMeter Jenkins plugin vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)

<4.22 · fixed in 4.22

Spring Framework URL Parsing with Host Validation

• Open redirect
• Server-side request forgery (SSRF)

<5.3.34 || >=6.0.0, <6.0.19 || >=6.1.0, <6.1.6 · fixed in 5.3.34, 6.0.19, 6.1.6

Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

• Broken access control

>=3.5.0, <3.6.2 · fixed in 3.6.2

Code injection in Apache Zeppelin Shell

• Code injection

>=0.10.1, <0.11.1 · fixed in 0.11.1

XWiki Platform remote code execution from account through UIExtension parameters

• Broken access control

<14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9-rc-1 · fixed in 14.10.19, 15.5.4, 15.9-rc-1

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

• Code injection

>=3.0.1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9-rc-1 · fixed in 14.10.19, 15.5.4, 15.9-rc-1

XWiki Platform CSRF remote code execution through the realtime HTML Converter API

• Cross-site request forgery (CSRF)

>=13.9-rc-1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9 · fixed in 14.10.19, 15.5.4, 15.9

XWiki Platform remote code execution from account via custom skins support

• Broken access control

>=6.4-milestone-1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1 · fixed in 14.10.19, 15.5.4, 15.10-rc-1

XWiki Platform CSRF remote code execution through scheduler job's document reference

• Code injection
• Cross-site request forgery (CSRF)

>=3.1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9 · fixed in 14.10.19, 15.5.4, 15.9

XWiki Platform CSRF in the job scheduler

• Cross-site request forgery (CSRF)

>=3.1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9 · fixed in 14.10.19, 15.5.4, 15.9

XWiki Platform: Remote code execution through space title and Solr space facet

• Code injection

>=7.2-rc-1, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1 · fixed in 14.10.20, 15.5.4, 15.10-rc-1

XWiki Platform: Remote code execution from edit in multilingual wikis via translations

• Broken access control

>=4.3-milestone-2, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1 · fixed in 14.10.20, 15.5.4, 15.10-rc-1

XWiki Platform: Remote code execution as guest via DatabaseSearch

• Code injection

>=2.4-milestone-1, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1 · fixed in 14.10.20, 15.5.4, 15.10-rc-1

XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

• Broken access control

>=3.0.1, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1 · fixed in 14.10.20, 15.5.4, 15.10-rc-1

XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

• Code injection

>=5.2-milestone-2, <14.10.20 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.10-rc-1 · fixed in 14.10.20, 15.5.4, 15.10-rc-1

XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted

• Information disclosure
• Weak cryptography or TLS

>=5.0-rc-1, <14.10.19 || >=15.0-rc-1, <15.5.4 || >=15.6-rc-1, <15.9-rc-1 · fixed in 14.10.19, 15.5.4, 15.9-rc-1

WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log

• CWE-345

<2.2.5.Final · fixed in 2.2.5.Final