Maven Advisories.

Ant-Media-Server vulnerable to Improper Output Neutralization for Logs

• Memory corruption

<2.9.0 · fixed in 2.9.0

Querydsl vulnerable to HQL injection through orderBy

• SQL injection

<=5.1.0 · no fixed version yet

Jenkins Filesystem List Parameter Plugin has Path Traversal vulnerability

• Path traversal

<0.0.15 · fixed in 0.0.15

Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<1.4.5 · fixed in 1.4.5

sigstore-java has vulnerability with bundle verification

• Weak cryptography or TLS
• CWE-345

>=1.0.0, <1.1.0 · fixed in 1.1.0

Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination

• Weak cryptography or TLS

<26.0.6 · fixed in 26.0.6

Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

• HTTP request smuggling

* || >=25.0.0, <26.0.6 · fixed in 26.0.6

Keycloak Build Process Exposes Sensitive Data

• Hard-coded credentials

<24.0.9 || >=25.0.0, <26.0.6 · fixed in 24.0.9, 26.0.6

Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

• Path traversal

<26.0.6 || >=25.0.0, <26.0.6 · fixed in 26.0.6

org.keycloak:keycloak-services has Inefficient Regular Expression Complexity

• Denial of service

<24.0.9 || >=25.0.0, <26.0.6 · fixed in 24.0.9, 26.0.6

Duplicate Advisory: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

• HTTP request smuggling

<24.0.9 || >=25.0.0, <26.0.6 · fixed in 24.0.9, 26.0.6

Duplicate Advisory: Keycloak Build Process Exposes Sensitive Data

• Hard-coded credentials

<24.0.9 || >=25.0.0, <26.0.6 · fixed in 24.0.9, 26.0.6

Duplicate Advisory: org.keycloak:keycloak-services has Inefficient Regular Expression Complexity

• Denial of service

<24.0.9 || >=25.0.0, <26.0.6 · fixed in 24.0.9, 26.0.6

Duplicate Advisory: Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

• Path traversal

<24.0.9 || >=25.0.0, <26.0.6 · fixed in 24.0.9, 26.0.6

Searching Opencast may cause a denial of service

• Denial of service

>=11.4, <13.10 || >=14.0, <14.3 || >=15.0, <16.7 · fixed in 13.10, 14.3, 16.7

Duplicate Advisory: Querydsl SQL/HQL injection

• SQL injection

<=5.1.0 · no fixed version yet

Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

• Privilege escalation
• Information disclosure

>=2.3.0, <3.7.1 · fixed in 3.7.1

Graylog concurrent PDF report rendering can leak other users' reports

• Information disclosure

>=6.1.0, <6.1.2 · fixed in 6.1.2

Apache Tomcat - XSS in generated JSPs

• Weak cryptography or TLS

>=9.0.96, <9.0.97 || >=11.0.0, <11.0.1 || >=10.1.31, <10.1.32 · fixed in 9.0.97, 11.0.1, 10.1.32

Apache Tomcat - Authentication Bypass

• CWE-391
• CWE-754

<9.0.96 || >=10.1.0-M1, <10.1.30 || >=11.0.0-M1, <11.0.1 · fixed in 9.0.96, 10.1.30, 11.0.1

Apache Tomcat Request and/or response mix-up

• Weak cryptography or TLS

>=9.0.92, <9.0.96 || >=10.1.27, <10.1.31 || >=11.0.0-M23, <11.0.0 · fixed in 9.0.96, 10.1.31, 11.0.0

Spring MVC controller vulnerable to a DoS attack

• Denial of service

>=5.3.0, <5.3.42 · fixed in 5.3.42

Debezium database connector has a script injection vulnerability

• CWE-233

<2.3.0.Alpha1 · fixed in 2.3.0.Alpha1

Undertow incorrectly parses cookies

• HTTP request smuggling

>=2.3.0.Alpha1, <2.3.11.Final || <2.2.30.Final · fixed in 2.3.11.Final, 2.2.30.Final

FitNesse Path Traversal

• Path traversal

<20241026 · fixed in 20241026

FitNesse Cross-site scripting

• Cross-site scripting (XSS)

<20241026 · fixed in 20241026

Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin

• Broken access control

<2.2218.v56d0cda · fixed in 2.2218.v56d0cda

Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

• Broken access control
• CWE-354

<3993.v3e20a · fixed in 3993.v3e20a

Missing permission check in Jenkins Script Security Plugin

• Authentication bypass
• Broken access control

<1368.vb · fixed in 1368.vb

Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

• Authentication bypass

<4.421.v5422614eb · fixed in 4.421.v5422614eb

Stored XSS vulnerability in Jenkins Authorize Project Plugin

• Cross-site scripting (XSS)

<1.8.0 · fixed in 1.8.0

Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin

• Broken access control

<19.v3a · fixed in 19.v3a

Denial of Service attack on windows app using netty

• Denial of service

<4.1.115.Final · fixed in 4.1.115.Final

powertac-server XML External Entity vulnerability

• Cross-site scripting (XSS)

<=1.9.0 · no fixed version yet

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

• XML external entities (XXE)

<6.4.0 · fixed in 6.4.0

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

• Memory corruption
• Insecure deserialization

<1.4.21 · fixed in 1.4.21

Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

• Authentication bypass

>=3.9.0, <3.9.3 · fixed in 3.9.3

hibernate-validator Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<6.2.0.Final · fixed in 6.2.0.Final

Undertow Denial of Service vulnerability

• Denial of service
• CWE-20

<2.2.32.Final || >=2.3.0.Alpha1, <2.3.13.Final · fixed in 2.2.32.Final, 2.3.13.Final

Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability

• Denial of service

>=11.0.0-M1, <11.0.0-M21 || >=10.1.0-M1, <10.1.25 || >=9.0.13, <9.0.90 || >=8.5.35, <=8.5.100 || >=7.0.92, <=7.0.109 · fixed in 11.0.0-M21, 10.1.25, 9.0.90

HAPI FHIR XML External Entity (XXE) vulnerability

• Open redirect
• XML external entities (XXE)

<6.4.0 · fixed in 6.4.0

Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (`GHSL-2024-074`)

• Path traversal

>=3.3.0, <3.5.12 · fixed in 3.5.12

hornetq vulnerable to file overwrite, sensitive information disclosure

• Path traversal
• Information disclosure

<=2.4.9 · no fixed version yet

Apache Kylin Session Fixation vulnerability

• Authentication bypass

>=2.0.0, <5.0.0 · fixed in 5.0.0

JeecgBoot SQL Injection vulnerability

• SQL injection

<=3.7.1 · no fixed version yet

Snowflake JDBC Security Advisory

• Weak cryptography or TLS

>=3.2.6, <3.20.0 · fixed in 3.20.0

Apache NiFi Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=1.10.0, <1.28.0 || >=2.0.0-M1, <2.0.0-M4 · fixed in 1.28.0, 2.0.0-M4

MPXJ has a Potential Path Traversal Vulnerability

• Path traversal

>=8.3.5, <13.5.1 · fixed in 13.5.1

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

• Broken access control
• Denial of service

>=5.0.0, <5.7.13 || >=5.8.0, <5.8.15 || >=6.2.0, <6.2.7 || >=6.0.0, <6.0.13 || >=6.1.0, <6.1.11 || >=6.3.0, <6.3.4 · fixed in 5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4

OpenRefine has a path traversal in LoadLanguageCommand

• Path traversal

<3.8.3 · fixed in 3.8.3

OpenRefine leaks Google API credentials in releases

• Hard-coded credentials

<3.8.3 · fixed in 3.8.3

Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

• Code injection
• CWE-185

<1.2.6 · fixed in 1.2.6

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

• Path traversal
• Server-side request forgery (SSRF)

<1.2.6 · fixed in 1.2.6

OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

• Cross-site scripting (XSS)
• CWE-81

<3.8.3 · fixed in 3.8.3

OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

• SQL injection

>=3.4-beta, <3.8.3 · fixed in 3.8.3

OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand

• Cross-site scripting (XSS)
• CWE-348

<3.8.3 · fixed in 3.8.3

OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

• Code injection
• Cross-site request forgery (CSRF)

<3.8.3 · fixed in 3.8.3

OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

• Cross-site scripting (XSS)

<3.8.3 · fixed in 3.8.3

Apache Syncope: Stored XSS in Console and Enduser

• Cross-site scripting (XSS)
• CWE-20

>=2.1.0, <=2.1.14 · no fixed version yet

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor

• Cross-site request forgery (CSRF)

>=2023.Q4.0, <2023.Q4.3 || >=2023.Q3.1, <2023.Q3.6 || >=7.3.GA, <7.3u36 || >=7.4.GA, <7.4u93 · fixed in 2023.Q4.3, 2023.Q3.6, 7.3u36, 7.4u93