Maven Advisories.

Session Fixation Apache DolphinScheduler

• Authentication bypass

>=1.3.8, <3.2.1 · fixed in 3.2.1

Arbitrary File Read Vulnerability in Apache Dolphinscheduler

• Code injection

<3.2.1 · fixed in 3.2.1

Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character

• Open redirect

<7.2.10.fp19 || >=7.3.0, <7.3.10.u4 || >=7.4.0, <7.4.13.u19 · fixed in 7.2.10.fp19, 7.3.10.u4, 7.4.13.u19

Liferay Portal defaults to a low work factor for the default password hashing algorithm

• Weak cryptography or TLS

<38.0.0 · fixed in 38.0.0

Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes

• Open redirect

>=7.2.10.fp15, <=7.2.10.fp18 || >=7.4.0, <7.4.13.u9 · fixed in 7.4.13.u9

Improper Certificate Validation in Apache DolphinScheduler

• Weak cryptography or TLS

<3.2.1 · fixed in 3.2.1

Remote Code Execution in Apache Dolphinscheduler

• Code injection

>=3.0.0, <3.2.1 · fixed in 3.2.1

Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions

• Broken access control

<7.2.10.fp17 · fixed in 7.2.10.fp17

Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API

• Broken access control

<7.2.10.fp17 · fixed in 7.2.10.fp17

Liferay Portal has an XXE vulnerability in Java2WsddTask._format

• XML external entities (XXE)

<14.0.0 · fixed in 14.0.0

Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options

• Broken access control

<7.2.10.fp15 · fixed in 7.2.10.fp15

Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel

• Information disclosure

<7.2.10.fp19 || >=7.3.0, <7.3.10.u4 · fixed in 7.2.10.fp19, 7.3.10.u4

Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

• Broken access control

>=6.1.0, <6.1.7 || >=6.2.0, <6.2.2 · fixed in 6.1.7, 6.2.2

Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page

• Open redirect

>=2023.Q3, <2023.Q3.6 || >=7.4.0, <=7.4.13.u92 · fixed in 2023.Q3.6

Privilege escalation in Liferay Portal

• Broken access control

<7.4.3.16 · fixed in 7.4.3.16

Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page

• Open redirect

>=2023.Q3, <2023.Q3.6 || >=7.4.13.u45, <=7.4.13.u92 · fixed in 2023.Q3.6

Undertow Uncontrolled Resource Consumption Vulnerability

• Denial of service

>=2.3.0.Final, <2.3.12.Final || <2.2.31.Final · fixed in 2.3.12.Final, 2.2.31.Final

Duplicate Advisory: SQL injection in pgjdbc

• SQL injection

>=42.7.0, <42.7.2 || >=42.6.0, <42.6.1 || >=42.5.0, <42.5.5 || >=42.4.0, <42.4.4 || >=42.3.0, <42.3.9 || <42.2.8 · fixed in 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.8

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

• Denial of service

>=1.21, <1.26.0 · fixed in 1.26.0

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

• Denial of service

>=1.3, <1.26.0 · fixed in 1.26.0

Vulnerability affecting the org.openjfx:javafx-media maven component of the OpenJFX project

<17.0.10 || >=18, <21.0.2 · fixed in 17.0.10, 21.0.2

Hazelcast Platform permission checking in CSV File Source connector

• SQL injection

>=5.3.0, <5.3.5 || >=5.2.0, <5.2.5 || <=5.1.7 · fixed in 5.3.5, 5.2.5

Absolute path traversal vulnerability in digdag server

• Path traversal

<0.10.5.1 · fixed in 0.10.5.1

Undertow Path Traversal vulnerability

• Path traversal

<2.2.31.Final || >=2.3.0.Alpha1, <2.3.12.Final · fixed in 2.2.31.Final, 2.3.12.Final

OpenRefine JDBC Attack Vulnerability

• Path traversal
• Broken access control

<3.7.8 · fixed in 3.7.8

Denial of Service in Connect2id Nimbus JOSE+JWT

• Denial of service

<9.37.2 · fixed in 9.37.2

angular vulnerable to super-linear runtime due to backtracking

• Denial of service

>=1.3.0, <=1.8.3 · no fixed version yet

Apache Solr's Streaming Expressions allow users to extract data from other Solr Clouds

• Information disclosure

>=9.0.0, <9.4.1 || >=6.0.0, <8.11.3 · fixed in 9.4.1, 8.11.3

Apache Solr Schema Designer blindly "trusts" all configsets

• Broken access control

>=9.0.0, <9.3.0 || >=8.10.0, <8.11.3 · fixed in 9.3.0, 8.11.3

Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies

• Hard-coded credentials

>=6.0.0, <8.11.3 || >=9.0.0, <9.3.0 · fixed in 8.11.3, 9.3.0

Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

• Unrestricted file upload
• CWE-913

>=6.0.0, <8.11.3 || >=9.0.0, <9.4.1 · fixed in 8.11.3, 9.4.1

Micronaut management endpoints vulnerable to drive-by localhost attack

• CWE-15
• CWE-610

<3.8.3 · fixed in 3.8.3

XXL-JOB vulnerable to Server-Side Request Forgery

• Server-side request forgery (SSRF)

<=2.4.2 · no fixed version yet

Liferay Portal denial-of-service vulnerability

• Denial of service

>=7.2.0, <7.2.10.fp19 || >=7.3.0, <7.3.10.u6 || >=7.4.0, <7.4.13.u27 · fixed in 7.2.10.fp19, 7.3.10.u6, 7.4.13.u27

Liferay Portal vulnerable to user impersonation

• Information disclosure

>=7.2.0, <7.2.10.fp15 || >=7.3.0, <7.3.10.u4 · fixed in 7.2.10.fp15, 7.3.10.u4

Liferay Portal allows attackers to discover the existence of sites

• Information disclosure
• CWE-204

>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp18 · fixed in 7.3.10.u4, 7.2.10.fp18

Liferay Portal's account lockout does not invalidate existing user sessions

• Authentication bypass

>=7.2.0, <7.2.10.fp5 · fixed in 7.2.10.fp5

Graylog session fixation vulnerability through cookie injection

• Authentication bypass

>=4.3.0, <5.1.11 || >=5.2.0-alpha.1, <5.2.4 · fixed in 5.1.11, 5.2.4

Graylog vulnerable to instantiation of arbitrary classes triggered by API request

• Broken access control

>=2.0.0, <5.1.11 || >=5.2.0-alpha.1, <5.2.4 · fixed in 5.1.11, 5.2.4

Liferay Portal stored cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

>=7.4.0, <7.4.3.13u8 || >=7.3.0, <7.3.10.u4 || <7.2.10.fp17 · fixed in 7.4.3.13u8, 7.3.10.u4, 7.2.10.fp17

Liferay Portal denial of service (memory consumption)

• Denial of service

>=7.2.0, <7.3.7 · fixed in 7.3.7

Apache Ozone Improper Authentication vulnerability

• Authentication bypass

>=1.2.0, <1.4.0 · fixed in 1.4.0

Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability

• Information disclosure

<2.11.3 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.1 · fixed in 2.11.3, 3.0.2, 3.1.1

Apache Sling Servlets Resolver executes malicious code via path traversal

• Path traversal

<2.11.0 · fixed in 2.11.0

Spring Security's spring-security.xsd file is world writable

• Broken access control

>=6.1.1, <6.1.4 || >=6.0.4, <6.0.7 || >=5.8.4, <5.8.7 || >=5.7.9, <5.7.11 · fixed in 6.1.4, 6.0.7, 5.8.7, 5.7.11

mingSoft MCMS File Upload vulnerability

• Unrestricted file upload

<=5.3.5 · no fixed version yet

Malicious input can provoke XSS when preserving comments

• Cross-site scripting (XSS)

<1.7.5 · fixed in 1.7.5

Central Dogma Authentication Bypass Vulnerability via Session Leakage

• Cross-site scripting (XSS)

<0.64.1 · fixed in 0.64.1

Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage

<0.64.0 · fixed in 0.64.0

Beetl Server-Side Template Injection vulnerability

• Code injection

<3.15.13.RELEASE · fixed in 3.15.13.RELEASE

Spring Cloud Contract vulnerable to local information disclosure

• Broken access control
• CWE-377

>=4.1.0, <4.1.1 || >=4.0.0, <4.0.5 || >=3.1.0, <3.1.10 · fixed in 4.1.1, 4.0.5, 3.1.10

CrateDB database has an arbitrary file read vulnerability

• Path traversal

<5.3.9 || >=5.4.0, <5.4.8 || >=5.5.0, <5.5.4 || >=5.6.0, <5.6.1 · fixed in 5.3.9, 5.4.8, 5.5.4, 5.6.1

CrateDB authentication bypass vulnerability

• Authentication bypass

<5.2.11 || >=5.3.0, <5.3.8 || >=5.4.0, <5.4.7 || >=5.5.0, <5.5.2 · fixed in 5.2.11, 5.3.8, 5.4.7, 5.5.2

Apache Kylin has Insufficiently Protected Credentials

• Hard-coded credentials

>=2.0.0, <4.0.4 · fixed in 4.0.4

Quarkus Improper Handling of Insufficient Permissions or Privileges and Improper Handling of Exceptional Conditions vulnerability

• Insecure deserialization
• CWE-280

<2.13.9.Final || >=3.0.0.Final, <3.2.9.Final · fixed in 2.13.9.Final, 3.2.9.Final

Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin

• Cross-site scripting (XSS)

<0.9.0 · fixed in 0.9.0

Arbitrary file read vulnerability in Git server Plugin can lead to RCE

• Path traversal

<99.101.v720e86326c09 · fixed in 99.101.v720e86326c09

Arbitrary file read vulnerability in Jenkins Log Command Plugin

• Path traversal

<=1.0.2 · no fixed version yet

Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin

• Information disclosure

<688.v5fa · fixed in 688.v5fa

Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin

• CWE-697

<688.v5fa · fixed in 688.v5fa