Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 8.1 High
Absent Input Validation in BinaryHttpParser
- CWE-20
<0.0.13.Final · fixed in 0.0.13.Final
GHSA-q8f2-hxq5-cp4h · CVE-2024-40642 - CVSS 5.4 Medium
The OpenSearch reporting plugin improperly controls tenancy access to reporting resources
- Broken access control
<2.14.0.0 · fixed in 2.14.0.0
GHSA-xmvg-335g-x44q · CVE-2024-39900 - CVSS 8.8 High
Apache StreamPark: FreeMarker SSTI RCE Vulnerability
- Code injection
<2.1.4 · fixed in 2.1.4
GHSA-vv8h-m63v-53pq · CVE-2024-29178 - CVSS 5.9 Medium
Apache StreamPark: Information leakage vulnerability
- Information disclosure
- CWE-212
>=2.0.0, <2.1.4 · fixed in 2.1.4
GHSA-hcf8-5j78-887v · CVE-2024-29120 - CVSS 8.6 High
Eclipse Parsson stack overflow when parsing deeply nested input
- Memory corruption
>=1.1.0, <1.1.3 || <1.0.4 · fixed in 1.1.3, 1.0.4
GHSA-2rwm-xv5j-777p · CVE-2023-7272 - CVSS 4.7 Medium
Apache StreamPark: Unchecked maven build params could trigger remote command execution
- Command injection
<2.1.4 · fixed in 2.1.4
GHSA-7g94-hfqc-q993 · CVE-2023-52291 - CVSS 4.7 Medium
Apache StreamPark: maven build params could trigger remote command execution
- Command injection
<2.1.4 · fixed in 2.1.4
GHSA-5v69-92vw-fmjh · CVE-2024-29737 - CVSS 8.8 High
Apache Linkis DataSource's JDBC Datasource Module with DB2 has JNDI Injection vulnerability
- Insecure deserialization
<1.6.0 · fixed in 1.6.0
GHSA-7qpc-4xx9-x5qw · CVE-2023-49566 - CVSS 7.5 High
Apache Linkis DataSource remote code execution vulnerability
- Insecure deserialization
>=1.4.0, <1.6.0 · fixed in 1.6.0
GHSA-jjvc-v8gw-5255 · CVE-2023-46801 - CVSS 6.5 Medium
Apache Linkis DataSource allows arbitrary file reading
- Information disclosure
>=1.4.0, <1.6.0 · fixed in 1.6.0
GHSA-f22j-9j59-33j4 · CVE-2023-41916 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Wicket: Remote code execution via XSLT injection
- Other injection
>=10.0.0-M1, <10.1.0 || >=9.0.0, <9.18.0 || >=8.0.0, <8.16.0 · fixed in 10.1.0, 9.18.0, 8.16.0
GHSA-hhwc-gh8h-9rrp · CVE-2024-36522 - CVSS 6.4 Medium
Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability
- Cross-site scripting (XSS)
>=4.0.0, <5.0.0 · fixed in 5.0.0
GHSA-vc8w-jr9v-vj7f · CVE-2024-6531 - CVSS 6.4 Medium
Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability
- Cross-site scripting (XSS)
>=2.0.0, <=3.4.1 · no fixed version yet
GHSA-9mvj-f7w8-pvh2 · CVE-2024-6484 - CVSS 4.2 Medium
OpenSearch Observability does not properly restrict access to private tenant resources
- Broken access control
<2.14.0.0 · fixed in 2.14.0.0
GHSA-77vc-rj32-2r33 · CVE-2024-39901 - CVSS 5.4 Medium
Silverpeas Core Cross-site Scripting vulnerability
- Cross-site scripting (XSS)
<=6.3.5 · no fixed version yet
GHSA-vfwh-gvf6-mff8 · CVE-2024-39031 - CVSS 8.2 High
Spring Cloud Function Framework vulnerable to Denial of Service
- CWE-20
>=4.0.0, <4.0.8 || >=4.1.0, <4.1.2 · fixed in 4.0.8, 4.1.2
GHSA-j4r7-p9fp-w3f3 · CVE-2024-22271 - CVSS 5.3 Medium
Undertow Missing Release of Memory after Effective Lifetime vulnerability
- Denial of service
>=2.3.0.Alpha1, <2.3.15.Final || <2.2.34.Final · fixed in 2.3.15.Final, 2.2.34.Final
GHSA-ch7q-gpff-h9hp · CVE-2024-3653 - CVSS 7.5 High
Undertow Denial of Service vulnerability
- Denial of service
>=2.3.0.Alpha1, <2.3.15.Final || <2.2.34.Final · fixed in 2.3.15.Final, 2.2.34.Final
GHSA-xpp6-8r3j-ww43 · CVE-2024-5971 - CVSS 4.6 Medium
Apache NiFi vulnerable to Cross-site Scripting
- Cross-site scripting (XSS)
>=1.10.0, <1.27.0 || >=2.0.0-M1, <2.0.0-M4 · fixed in 1.27.0, 2.0.0-M4
GHSA-h658-qqv9-qwv8 · CVE-2024-37389 - CVSS 7.5 High
Apache Tomcat - Denial of Service
- Denial of service
- CWE-755
>=11.0.0-M1, <11.0.0-M21 || >=10.1.0-M1, <10.1.25 || >=9.0.0-M1, <9.0.90 || >=8.5.0, <=8.5.100 · fixed in 11.0.0-M21, 10.1.25, 9.0.90
GHSA-wm9w-rjj3-j356 · CVE-2024-34750 - CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Remote Code Execution (RCE) vulnerability in geoserver
- Code injection
>=2.24.0, <2.24.4 || >=2.25.0, <2.25.2 || >=2.23.0, <2.23.6 || <2.22.6 · fixed in 2.24.4, 2.25.2, 2.23.6, 2.22.6
GHSA-6jj6-gm7p-fcvv · CVE-2024-36401 - CVSS 7.5 High
Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat
- Path traversal
<2.23.5 || >=2.24.0, <2.24.3 · fixed in 2.23.5, 2.24.3
GHSA-jhqx-5v5g-mpf3 · CVE-2024-24749 - CVSS 4.5 Medium
GeoServer's Server Status shows sensitive environmental variables and Java properties
- Information disclosure
>=2.10.0, <2.24.4 || >=2.25.0, <2.25.1 · fixed in 2.24.4, 2.25.1
GHSA-j59v-vgcr-hxvf · CVE-2024-34696 - CVSS 3.1 Low
Exposure of secrets through system log in Jenkins Structs Plugin
- Information disclosure
<338.v848422169819 · fixed in 338.v848422169819
GHSA-xfx3-cr74-x3cv · CVE-2024-39458 - CVSS 4.3 Medium
Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
- Information disclosure
<887.va · fixed in 887.va
GHSA-x8mf-jcmf-r79f · CVE-2024-39460 - CVSS 4.3 Medium
Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin
- Weak cryptography or TLS
- Information disclosure
<183.va · fixed in 183.va
GHSA-3cpq-rw36-cppv · CVE-2024-39459 - CVSS 2.6 Low
DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
- Cross-site scripting (XSS)
>=7.0, <7.6.2 · fixed in 7.6.2
GHSA-94cc-xjxr-pwvf · CVE-2024-38364 - CVSS 7.5 High
Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
- XML external entities (XXE)
>=2.1.0, <9.0.4 · fixed in 9.0.4
GHSA-683x-4444-jxh8 · CVE-2024-38374 - CVSS 10.0 CriticalCritical · CVSS 9+
XWiki programming rights may be inherited by inclusion
- Broken access control
<15.0-rc-1 · fixed in 15.0-rc-1
GHSA-qcj3-wpgm-qpxh · CVE-2024-38369 - CVSS 9.1 CriticalCritical · CVSS 9+
Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
- Weak cryptography or TLS
>=0.69.0, <0.95.0 · fixed in 0.95.0
GHSA-cf3q-vg8w-mw84 · CVE-2024-29868 - CVSS 6.3 Medium
Cross site scripting in Apache JSPWiki
- Cross-site scripting (XSS)
<2.12.2 · fixed in 2.12.2
GHSA-36gf-vpj2-j42w · CVE-2024-27136 - CVSS 2.7 Low
Keycloak leaks configured LDAP bind credentials through the Keycloak admin console
- Broken access control
>=25.0.0, <25.0.1 || <22.0.12 || >=23.0.0, <24.0.6 · fixed in 25.0.1, 22.0.12, 24.0.6
GHSA-c25h-c27q-5qpv · CVE-2024-5967 - CVSS 6.5 Medium
ClassGraph XML External Entity Reference
- XML external entities (XXE)
<4.8.112 · fixed in 4.8.112
GHSA-v2xm-76pq-phcf · CVE-2021-47621 - CVSS 9.1 CriticalCritical · CVSS 9+
XWiki Platform allows remote code execution from user account
- Code injection
- Privilege escalation
>=13.4.7, <14.10.21 || >=13.10.3, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.6 || >=16.0.0-rc-1, <16.0.0 · fixed in 14.10.21, 15.5.5, 15.10.6, 16.0.0
GHSA-j584-j2vj-3f93 · CVE-2024-37899 - CVSS 7.5 High
Undertow's url-encoded request path information can be broken on ajp-listener
- Denial of service
- CWE-488
>=2.3.0.Alpha1, <2.3.14.Final || <2.2.33.Final · fixed in 2.3.14.Final, 2.2.33.Final
GHSA-9442-gm4v-r222 · CVE-2024-6162 - CVSS 2.7 Low
Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials
- Broken access control
<=24.0.5 · no fixed version yet
GHSA-gmrm-8fx4-66x7 - CVSS 7.3 High
STRIMZI incorrect access control
- Authentication bypass
- Denial of service
<=0.41.0 · no fixed version yet
GHSA-q2xx-f8r3-9mg5 · CVE-2024-36543 - CVSS 10.0 CriticalCritical · CVSS 9+
DeepJavaLibrary API absolute path traversal
- Path traversal
>=0.1.0, <0.28.0 · fixed in 0.28.0
GHSA-w877-jfw7-46rj · CVE-2024-37902 - CVSS 4.9 Medium
SonarQube logs sensitive information
- Information disclosure
<9.9.4 · fixed in 9.9.4
GHSA-hw2c-8xgw-mf57 · CVE-2024-38460 - CVSS 5.3 Medium
CrateDB has a Client initialized Session-Renegotiation DoS
- Denial of service
<5.7.2 · fixed in 5.7.2
GHSA-x268-qpg6-w9g2 · CVE-2024-37309 - CVSS 4.9 Medium
Elasticsearch StackOverflow vulnerability
- Memory corruption
>=8.13.1, <8.14.0 · fixed in 8.14.0
GHSA-4q22-422g-m4pj · CVE-2024-37280 - CVSS 3.7 Low
Keycloak Denial of Service via account lockout
- CWE-640
- CWE-645
<24.0.0 · fixed in 24.0.0
GHSA-cq42-vhv7-xr7p · CVE-2024-1722 - CVSS 3.7 Low
Keycloak's improper input validation allows using email as username
- CWE-20
- CWE-670
<24.0.1 · fixed in 24.0.1
GHSA-4vc8-pg5c-vg4x · CVE-2021-3754 - CVSS 8.1 High
Apache Submarine Server Core has a SQL Injection Vulnerability
- SQL injection
<=0.8.0 · no fixed version yet
GHSA-v74c-qc46-9gg9 · CVE-2024-36263 - CVSS 8.1 High
Keycloak's admin API allows low privilege users to use administrative functions
- Information disclosure
- Privilege escalation
<24.0.5 · fixed in 24.0.5
GHSA-2cww-fgmg-4jqc · CVE-2024-3656 - CVSS 5.5 Medium
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
- Race condition
<1.6.0-beta.4.0.20240610221955-50774cd97099 · fixed in 1.6.0-beta.4.0.20240610221955-50774cd97099
GHSA-m5vv-6r4h-3vj9 · CVE-2024-35255 - CVSS 7.5 High
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
- Information disclosure
<24.0.5 · fixed in 24.0.5
GHSA-69fp-7c8p-crjr · CVE-2024-4540 - CVSS 7.5 High
Weak encryption in Ninja Core
- Weak cryptography or TLS
=7.0.0 · no fixed version yet
GHSA-92wp-jghr-hh87 · CVE-2024-36823 - CVSS 5.9 Medium
BoringSSLAEADContext in Netty Repeats Nonces
- Memory corruption
- Information disclosure
>=0.0.3.Final, <0.0.11.Final · fixed in 0.0.11.Final
GHSA-g762-h86w-8749 · CVE-2024-36121 - CVSS 5.3 Medium
iq80 Snappy out-of-bounds read when uncompressing data, leading to JVM crash
- Memory corruption
<0.5 · fixed in 0.5
GHSA-8wh2-6qhj-h7j9 · CVE-2024-36124 - CVSS 7.5 High
Duplicate Advisory: Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
- Information disclosure
<24.0.5 · fixed in 24.0.5
GHSA-4vrx-8phj-x3mg - CVSS 9.8 CriticalCritical · CVSS 9+
Silverpeas authentication bypass
- Authentication bypass
<6.3.5 · fixed in 6.3.5
GHSA-4w54-wwc9-x62c · CVE-2024-36042 - CVSS 8.6 High
Decompressors can crash the JVM and leak memory content in Aircompressor
- Memory corruption
<0.27 · fixed in 0.27
GHSA-973x-65j7-xcf4 · CVE-2024-36114 - CVSS 6.4 Medium
OpenCMS Cross-Site Scripting vulnerability
- Cross-site scripting (XSS)
>=16.0, <17.0 · fixed in 17.0
GHSA-vg6x-pchq-98mg · CVE-2024-5520 - CVSS 8.3 High
OpenAPI Generator Online - Arbitrary File Read/Delete
- Path traversal
<7.6.0 · fixed in 7.6.0
GHSA-g3hr-p86p-593h · CVE-2024-35219 - CVSS 7.5 High
Soot Infinite Loop vulnerability
- Denial of service
<4.4.1 · fixed in 4.4.1
GHSA-hfg7-j82c-fr3w · CVE-2023-46442 - CVSS 5.3 Medium
Kwik does not discard unused encryption keys
- Weak cryptography or TLS
- Denial of service
<0.8 · fixed in 0.8
GHSA-w8cp-frxc-55pj · CVE-2024-22588 - CVSS 4.3 Medium
Jenkins Report Info Plugin Path Traversal vulnerability
- Path traversal
<=1.2 · no fixed version yet
GHSA-cw5r-jx8r-9f7x · CVE-2024-5273 - CVSS 6.5 Medium
Eclipse Ditto vulnerable to Cross-site Scripting
- Cross-site scripting (XSS)
>=3.0.0, <3.4.5 || >=3.5.0, <3.5.6 · fixed in 3.4.5, 3.5.6
GHSA-hjfc-6jxr-j2rx · CVE-2024-5165 - CVSS 6.1 Medium
Silverpeas Core vulnerable to Cross Site Scripting
- Cross-site scripting (XSS)
<=6.3 · no fixed version yet
GHSA-9rrw-82r2-623p · CVE-2024-29392