Maven Advisories.

XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

• XML external entities (XXE)

<6.3.23 · fixed in 6.3.23

H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

• Insecure deserialization

<=3.46.0.7 · no fixed version yet

Vertx gRPC server does not limit the maximum message size

• Denial of service

>=4.3.0, <4.5.10 · fixed in 4.5.10

Duplicate Advisory: Keycloak has a brute force login protection bypass

• CWE-837

<24.0.4 · fixed in 24.0.4

Missing hostname validation in Kroxylicious

• Weak cryptography or TLS

<0.8.0 · fixed in 0.8.0

Signature forgery in Spring Boot's Loader

• Authentication bypass
• Weak cryptography or TLS

>=2.7.0, <2.7.22 || >=3.0.0, <3.0.17 || >=3.1.0, <3.1.13 || >=3.2.0, <3.2.9 || >=3.3.0, <3.3.3 · fixed in 2.7.22, 3.0.17, 3.1.13, 3.2.9, 3.3.3

Undertow vulnerable to Race Condition

• Race condition

<2.2.36.Final || >=2.3.0.Alpha1, <2.3.17.Final · fixed in 2.2.36.Final, 2.3.17.Final

Apache SeaTunnel SQL Injection vulnerability

• Information disclosure

>=1.0.0, <1.0.1 · fixed in 1.0.1

Apache Helix Front (UI) component contained a hard-coded secret

• Information disclosure

<=1.4.0 · no fixed version yet

apollo-portal has potential unauthorized access issue

• Broken access control

<2.3.0 · fixed in 2.3.0

Spring Framework vulnerable to Denial of Service

• Denial of service

<5.3.39 · fixed in 5.3.39

Apache Dolphinscheduler Code Injection vulnerability

• Code injection

>=3.1.0, <3.2.2 · fixed in 3.2.2

Spring Security Missing Authorization vulnerability

• Authentication bypass
• Broken access control

>=6.3.0, <6.3.2 · fixed in 6.3.2

In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

• Privilege escalation
• Broken access control

<15.10-rc-1 · fixed in 15.10-rc-1

XWiki Platform allows XSS through XClass name in string properties

• Cross-site scripting (XSS)
• Code injection

>=1.1.2, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.6 || >=16.0.0-rc-1, <16.0.0 · fixed in 14.10.21, 15.5.5, 15.10.6, 16.0.0

Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access

• Privilege escalation
• Broken access control

<1.10.0 · fixed in 1.10.0

Silverpeas vulnerable to password complexity rule bypass

• Hard-coded credentials

<=6.4.2 · no fixed version yet

Improper Preservation of Permissions in xxl-job

• Broken access control
• CWE-277

<2.4.2 · fixed in 2.4.2

Apache MINA SSHD: integrity check bypass

• CWE-354

<2.12.0 · fixed in 2.12.0

Apache DolphinScheduler: RCE by arbitrary js execution

• CWE-20

<3.2.2 · fixed in 3.2.2

Apache DolphinScheduler: Resource File Read And Write Vulnerability

• CWE-20

>=3.1.0, <3.2.2 · fixed in 3.2.2

CometVisu Backend for openHAB has a path traversal vulnerability

• Path traversal

<4.2.1 · fixed in 4.2.1

CometVisu Backend for openHAB affected by RCE through path traversal

• Path traversal

<4.2.1 · fixed in 4.2.1

CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

• Broken access control

<4.2.1 · fixed in 4.2.1

CometVisu Backend for openHAB affected by SSRF/XSS

• Server-side request forgery (SSRF)

>=3.4.0.M4, <4.2.1 · fixed in 4.2.1

Jenkins Remoting library arbitrary file read vulnerability

• Path traversal
• CWE-754

<2.452.4 || >=2.460, <2.462.1 || >=2.470, <2.471 · fixed in 2.452.4, 2.462.1, 2.471

Jenkins does not perform a permission check in an HTTP endpoint

• Broken access control

<2.452.4 || >=2.460, <2.462.1 || >=2.470, <2.471 · fixed in 2.452.4, 2.462.1, 2.471

Duplicate Advisory: Reposilite Arbitrary File Read vulnerability

• Path traversal

>=3.3.0, <3.5.12 · fixed in 3.5.12

XXL-RPC Deserialization of Untrusted Data vulnerability

• Insecure deserialization

<=1.7.0 · no fixed version yet

Redisson vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<3.22.0 · fixed in 3.22.0

Apereo CAS vulnerable to credential leaks for LDAP authentication

• Information disclosure
• Hard-coded credentials

>=6.5.0, <6.6.6 · fixed in 6.6.6

Alpine allows Authentication Filter bypass

• Authentication bypass
• CWE-697

<1.10.4 · fixed in 1.10.4

Alpine allows URL access filter bypass

• Broken access control

<1.10.4 · fixed in 1.10.4

Path traversal in Reposilite javadoc file expansion (arbitrary file creation/overwrite) (`GHSL-2024-073`)

• Path traversal

>=3.3.0, <3.5.12 · fixed in 3.5.12

Reposilite artifacts vulnerable to Stored Cross-site Scripting

• Cross-site scripting (XSS)

>=3.3.0, <3.5.12 · fixed in 3.5.12

Apache Linkis vulnerable to privilege escalation

• Privilege escalation

<1.6.0 · fixed in 1.6.0

Apache Inlong Code Injection vulnerability

• Code injection

>=1.10.0, <1.13.0 · fixed in 1.13.0

Apache Linkis arbitrary file deletion vulnerability

• Information disclosure

<1.6.0 · fixed in 1.6.0

biscuit-java vulnerable to public key confusion in third party block

• CWE-1259

>=3.0.0, <4.0.0 · fixed in 4.0.0

Elasticsearch stores private key on disk unencrypted

• Weak cryptography or TLS

>=8.0.0-alpha1, <8.13.0 || <7.17.23 · fixed in 8.13.0, 7.17.23

XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution

• Cross-site scripting (XSS)

>=11.8-rc-1, <15.10.8 || >=16.0.0-rc-1, <16.3.0-rc-1 · fixed in 15.10.8, 16.3.0-rc-1

XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet

• Code injection
• Broken access control

>=9.2-rc-1, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.2 · fixed in 14.10.21, 15.5.5, 15.10.2

XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

• Code injection

>=4.2-milestone-3, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.6 || >=16.0.0-rc-1, <16.0.0 · fixed in 14.10.21, 15.5.5, 15.10.6, 16.0.0

XWiki Platform vulnerable to document deletion and overwrite from edit

• Broken access control

>=13.10.4, <14.10.21 || >=14.2, <14.10.21 || >=15.0, <15.5.5 || >=15.6-rc-1, <15.10.6 · fixed in 14.10.21, 15.5.5, 15.10.6

Apache SeaTunnel Web Authentication vulnerability

• Authentication bypass

<1.0.1 · fixed in 1.0.1

GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

• Denial of service

<19.11 || >=20.0, <20.9 || >=21.0, <21.5 · fixed in 19.11, 20.9, 21.5

Elasticsearch Insertion of Sensitive Information into Log File

• Information disclosure

<7.17.16 || >=8.0.0, <8.11.2 · fixed in 7.17.16, 8.11.2

OpenAM FreeMarker template injection

• Code injection

<15.0.4 · fixed in 15.0.4

Remote code execution in Spring Cloud Data Flow

• Path traversal
• Code injection

<2.11.4 · fixed in 2.11.4

XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill

• XML external entities (XXE)

>=1.19.0, <1.21.2 · fixed in 1.21.2

Apache Pinot: Unauthorized endpoint exposed sensitive information

• Information disclosure

>=0.1, <1.0.0 · fixed in 1.0.0

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

• Denial of service

>=3.5.0, <3.6.0 · fixed in 3.6.0

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

• Denial of service

>=3.5.0, <3.6.0 · fixed in 3.6.0

DNSJava DNSSEC Bypass

• CWE-345
• CWE-349

<3.6.0 · fixed in 3.6.0

Apache Syncope Improper Input Validation vulnerability

• Cross-site scripting (XSS)
• CWE-20

>=2.1.0, <3.0.8 · fixed in 3.0.8

Apache RocketMQ Vulnerable to Unauthorized Exposure of Sensitive Data

• Information disclosure

>=4.5.2, <5.3.0 · fixed in 5.3.0

H2O vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<=3.46.0.4 · no fixed version yet

Apache CXF Denial of Service vulnerability in JOSE

• Denial of service
• CWE-20

>=4.0.0, <4.0.5 || >=3.6.0, <3.6.4 || <3.5.9 · fixed in 4.0.5, 3.6.4, 3.5.9

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

• Server-side request forgery (SSRF)

>=4.0.0, <4.0.5 || >=3.6.0, <3.6.4 || <3.5.9 · fixed in 4.0.5, 3.6.4, 3.5.9

Apache CXF allows unrestricted memory consumption in CXF HTTP clients

• Denial of service

>=4.0.0, <4.0.5 || >=3.6.0, <3.6.4 · fixed in 4.0.5, 3.6.4