Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 4.6 Medium
Path traversal vulnerability in Jenkins Matrix Project Plugin
- Path traversal
<822.824.v14451b · fixed in 822.824.v14451b
GHSA-cjgm-9vc9-56mx · CVE-2024-23900 - CVSS 4.3 Medium
CSRF vulnerability in Jenkins GitLab Branch Source Plugin
- Cross-site request forgery (CSRF)
<688.v5fa · fixed in 688.v5fa
GHSA-8r93-59cf-358f · CVE-2024-23902 - CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
- Path traversal
- CWE-27
>=1.606, <2.426.3 || >=2.427, <2.440.1 || >=2.441, <2.442 · fixed in 2.426.3, 2.440.1, 2.442
GHSA-6f9g-cxwr-q5jr · CVE-2024-23897 - CVSS 8.8 HighCritical · CVSS 7+ and EPSS
Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
- CWE-346
>=2.217, <2.426.3 || >=2.427, <2.442 · fixed in 2.426.3, 2.442
GHSA-53ph-2r2x-vqw8 · CVE-2024-23898 - CVSS 6.1 Medium
Cross-site Scripting in JFinal
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-qh2w-9m7w-hjg2 · CVE-2024-22497 - CVSS 9.8 CriticalCritical · CVSS 9+
Remote Command Execution in SOFARPC
- Insecure deserialization
<5.12.0 · fixed in 5.12.0
GHSA-7q8p-9953-pxvr · CVE-2024-23636 - CVSS 6.1 Medium
Cross-site Scripting in beetl-bbs
- Cross-site scripting (XSS)
<=2.0.0 · no fixed version yet
GHSA-v9wr-2xrg-v7w8 · CVE-2024-22490 - CVSS 6.1 Medium
Cross-site Scripting in JFinal
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-v435-pfj6-68r3 · CVE-2024-22496 - CVSS 4.6 Medium
keycloak-core: open redirect via "form_post.jwt" JARM response mode
- Open redirect
<23.0.4 · fixed in 23.0.4
GHSA-9vm7-v8wj-3fqw · CVE-2023-6927 - CVSS 7.5 High
Spring Framework server Web DoS Vulnerability
- Denial of service
>=6.1.2, <6.1.3 || >=6.0.15, <6.0.16 · fixed in 6.1.3, 6.0.16
GHSA-r4q3-7g4q-x89m · CVE-2024-22233 - CVSS 9.8 CriticalCritical · CVSS 9+
Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization
- Insecure deserialization
<1.9.0 · fixed in 1.9.0
GHSA-jgxc-8mwq-9xqw · CVE-2017-20189 - CVSS 5.3 Medium
Duplicate Advisory: Discovery uses the same AES/GCM Nonce throughout the session
- Weak cryptography or TLS
- CWE-323
<0.4.5 · fixed in 0.4.5
GHSA-wp4m-7hpj-8qp8 - CVSS 5.3 Medium
Insertion of Sensitive Information into Log File in OWASP DependencyCheck
- Information disclosure
>=9.0.0, <9.0.6 · fixed in 9.0.6
GHSA-frxm-v7q3-v2wv · CVE-2024-23686 - CVSS 9.1 Critical
Duplicate Advisory: Hard-coded credentials in org.folio:mod-data-export-spring
- Hard-coded credentials
<1.5.4 || >=2.0.0, <3.0.0 · fixed in 1.5.4, 3.0.0
GHSA-9rhq-86fm-qxqc - CVSS 5.3 Medium
Duplicate Advisory: Hard-coded credentials in org.folio:mod-remote-storage
- Hard-coded credentials
>=2.0.0, <2.0.3 || <1.7.2 · fixed in 2.0.3, 1.7.2
GHSA-hv5g-q4h3-64q4 - CVSS 6.1 Medium
Duplicate Advisory: JavaScript execution via malicious molfiles (XSS)
- Cross-site scripting (XSS)
<0.3.0 · fixed in 0.3.0
GHSA-wc6f-qjxc-622v - CVSS 8.2 High
Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox
- CWE-501
<1.8.0 · fixed in 1.8.0
GHSA-hj55-9jmv-9jrj - CVSS 7.5 High
Duplicate Advisory: Inefficient Algorithmic Complexity in com.upokecenter:cbor
- Denial of service
>=4.0.0, <4.5.1 · fixed in 4.5.1
GHSA-hfj8-63c8-rmfw - CVSS 5.3 Medium
Duplicate Advisory: Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
- Weak cryptography or TLS
<1.9.0 || >=2.0.0, <2.2.0 · fixed in 1.9.0, 2.2.0
GHSA-gvc7-gjrw-hj65 - CVSS 8.2 High
Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox
- Code injection
- Broken access control
<1.11.2 · fixed in 1.11.2
GHSA-c4pg-5ggh-vcpp - CVSS 9.8 Critical
Duplicate Advisory: Session fixation in Enonic XP
- Authentication bypass
<7.7.4 · fixed in 7.7.4
GHSA-4hrp-m3f2-643j - CVSS 8.8 High
Duplicate Advisory: Exposure of sensitive information in ClickHouse
- Information disclosure
<0.4.6 · fixed in 0.4.6
GHSA-3p77-wg4c-qm24 - CVSS 8.2 High
Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox
<1.7.6 · fixed in 1.7.6
GHSA-23rx-79r7-6cpx - CVSS 5.3 Medium
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
- Information disclosure
>=8.5.7, <8.5.64 || >=9.0.0-M11, <9.0.44 · fixed in 8.5.64, 9.0.44
GHSA-f4qf-m5gf-8jm8 · CVE-2024-21733 - CVSS 5.4 Medium
Stored Cross Site Scripting in beetl-bbs
- Cross-site scripting (XSS)
<=2.0.0 · no fixed version yet
GHSA-32q4-86g8-6637 · CVE-2024-22491 - CVSS 7.5 High
Code injection in mingSoft MCMS
- Code injection
<=5.2.4 · no fixed version yet
GHSA-h57w-vh34-f8cw · CVE-2023-51282 - CVSS 6.5 Medium
Apache Shiro vulnerable to path traversal
- Path traversal
<1.13.0 || >=2.0.0alpha1, <2.0.0-alpha4 · fixed in 1.13.0, 2.0.0-alpha4
GHSA-jc7h-c423-mpjc · CVE-2023-46749 - CVSS 6.5 Medium
Apache Solr allows read access to host environmet variables
- Information disclosure
>=9.0.0, <9.3.0 · fixed in 9.3.0
GHSA-gg7w-pw2r-x2cq · CVE-2023-50290 - CVSS 5.4 Medium
Cross-site Scripting in JFinal
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-859h-4w58-78xw · CVE-2024-22492 - CVSS 5.4 Medium
Cross-site Scripting in JFinal
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-3j4x-9q9q-3277 · CVE-2024-22493 - CVSS 5.7 Medium
Qualys Jenkins Plugin for Policy Compliance Cross-site Scripting vulnerability
- Cross-site scripting (XSS)
<1.0.6 · fixed in 1.0.6
GHSA-rwf9-8fqr-p44m · CVE-2023-6148 - CVSS 5.7 Medium
Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability
- XML external entities (XXE)
<1.0.6 · fixed in 1.0.6
GHSA-8525-52vg-jv6v · CVE-2023-6147 - CVSS 5.7 Medium
Qualys Jenkins Plugin for WAS XML External Entity vulnerability
- XML external entities (XXE)
<2.0.12 · fixed in 2.0.12
GHSA-5gwh-r76w-934h · CVE-2023-6149 - CVSS 7.5 High
XWiki vulnerable to Denial of Service attack through attachments
- Denial of service
>=14.10, <14.10.18 || >=15.0-rc-1, <15.5.3 || >=15.6-rc-1, <15.8-rc-1 · fixed in 14.10.18, 15.5.3, 15.8-rc-1
GHSA-8959-rfxh-r4j4 · CVE-2024-21651 - CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
XWiki Remote Code Execution Vulnerability via User Registration
- Code injection
>=2.2, <14.10.17 || >=15.0-rc-1, <15.5.3 || >=15.6-rc-1, <15.8-rc-1 · fixed in 14.10.17, 15.5.3, 15.8-rc-1
GHSA-rj7p-xjv7-7229 · CVE-2024-21650 - CVSS 8.0 High
XWiki has no right protection on rollback action
- CWE-274
>=15.0-rc-1, <15.5.3 || >=15.6-rc-1, <15.8-rc-1 · fixed in 15.5.3, 15.8-rc-1
GHSA-xh35-w7wg-95v3 · CVE-2024-21648 - CVSS 7.2 High
Apache Axis Improper Input Validation vulnerability
- Server-side request forgery (SSRF)
- CWE-20
<=1.3 · no fixed version yet
GHSA-hr2c-p8rh-238h · CVE-2023-51441 - CVSS 7.5 High
Ion Java StackOverflow vulnerability
- Denial of service
<1.10.5 · fixed in 1.10.5
GHSA-264p-99wq-f4j6 · CVE-2024-21634 - CVSS 7.5 High
Apache InLong Manager Arbitrary File Read Vulnerability
- Insecure deserialization
>=1.5.0, <1.10.0 · fixed in 1.10.0
GHSA-crwj-2r3c-gx2g · CVE-2023-51785 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache InLong Manager Remote Code Execution vulnerability
- Code injection
>=1.5.0, <1.10.0 · fixed in 1.10.0
GHSA-9xg9-hh45-xcm6 · CVE-2023-51784 - CVSS 8.8 High
Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
- CWE-20
<3.1.9 · fixed in 3.1.9
GHSA-v7hg-77v9-2445 · CVE-2023-49299 - CVSS 8.8 High
Mingsoft MCMS SQL injection
- SQL injection
<=5.2.9 · no fixed version yet
GHSA-3vvh-8c65-32j4 · CVE-2023-50578 - CVSS 9.1 CriticalCritical · CVSS 9+
JeecgBoot server-side template injection
- Code injection
<=3.5.3 · no fixed version yet
GHSA-49jp-cghc-p5pj · CVE-2023-41544 - CVSS 9.8 CriticalCritical · CVSS 9+
Jeecg Boot SQL Injection
- SQL injection
<=3.5.3 · no fixed version yet
GHSA-fr29-w6j4-525f · CVE-2023-41543 - CVSS 9.8 CriticalCritical · CVSS 9+
Jeecg Boot SQL injection vulnerability
- SQL injection
<=3.5.3 · no fixed version yet
GHSA-5v9r-788c-wc8p · CVE-2023-41542 - CVSS 4.3 Medium
Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions
- Authentication bypass
>=15.0.0.Dev01, <15.0.0.Dev04 || <14.0.18.Final · fixed in 15.0.0.Dev04, 14.0.18.Final
GHSA-r4w2-hjmr-36m7 · CVE-2023-3629 - CVSS 6.5 Medium
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
- Authentication bypass
>=15.0.0.Dev01, <15.0.0.Dev04 || <14.0.18.Final · fixed in 15.0.0.Dev04, 14.0.18.Final
GHSA-fhr7-8jx4-r9cp · CVE-2023-3628 - CVSS 5.5 Medium
IPAddress Infinite Loop vulnerability (Disputed)
- Denial of service
<=5.4.0 · no fixed version yet
GHSA-qphf-w3cq-jpmx · CVE-2023-50570 - CVSS 7.8 High
easy-rules-mvel vulnerable to remote code execution
=4.1.0 · no fixed version yet
GHSA-fgwc-3j6w-ch22 · CVE-2023-50571 - CVSS 5.5 Medium
JLine vulnerable to out of memory error
- Memory corruption
<3.25.0 · fixed in 3.25.0
GHSA-2268-98wh-qfhf · CVE-2023-50572 - CVSS 5.0 Medium
ShifuML shifu code injection vulnerability
- Code injection
<=0.12.0 · no fixed version yet
GHSA-5fpq-3c9p-3r3w · CVE-2023-7148 - CVSS 4.4 Medium
Infinispan circular object references causes out of memory errors
- CWE-1047
<4.6.2.Final · fixed in 4.6.2.Final
GHSA-488m-w9fp-5mm2 · CVE-2023-5236 - CVSS 7.2 High
Infinispan caches credentials in clear text
- Information disclosure
>=15.0.0.Dev01, <15.0.0.Dev07 || <14.0.25.Final · fixed in 15.0.0.Dev07, 14.0.25.Final
GHSA-gg57-587f-h5v6 · CVE-2023-5384 - CVSS 9.8 CriticalCritical · CVSS 9+
hyavijava stack overflow vulnerability
- Memory corruption
<=6.0.07.1 · no fixed version yet
GHSA-xhgx-7974-c8v6 · CVE-2023-51084 - CVSS 5.3 Medium
json-path Out-of-bounds Write vulnerability
- Memory corruption
>=2.2.0, <2.9.0 · fixed in 2.9.0
GHSA-pfh2-hfmq-phg5 · CVE-2023-51074 - CVSS 7.5 High
hutool-core was discovered to contain a stack overflow via NumberUtil.toBigDecimal method
- Memory corruption
>=5.8.22, <5.8.25 · fixed in 5.8.25
GHSA-m5hf-m3r2-xq53 · CVE-2023-51080 - CVSS 5.3 Medium
mvel2 TimeOut error exists in the ParseTools.subCompileExpression method
=2.5.0.Final · no fixed version yet
GHSA-h63j-xqx6-w58r · CVE-2023-51079 - CVSS 7.5 High
hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function
- Denial of service
<5.8.24 · fixed in 5.8.24
GHSA-7m7h-rgvp-3v4r · CVE-2023-51075 - CVSS 5.4 Medium
OpenCRX Cross-site Scripting vulnerability
- Cross-site scripting (XSS)
<=5.2.0 · no fixed version yet
GHSA-8wjx-p2f8-5rjp · CVE-2023-27150 - CVSS 4.8 Medium
WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability
- Cross-site scripting (XSS)
<4.7.37 · fixed in 4.7.37
GHSA-rfq3-wpjh-ppvg · CVE-2023-6911