Maven Advisories.

JRuby-OpenSSL has hostname verification disabled by default

• Weak cryptography or TLS

>=10.0.0.0, <10.0.0.1 || >=9.3.4.0, <9.4.12.1 · fixed in 10.0.0.1, 9.4.12.1

Graylog Allows Session Takeover via Insufficient HTML Sanitization

• Cross-site scripting (XSS)

<6.0.14 || >=6.1.0, <6.1.10 · fixed in 6.0.14, 6.1.10

Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser

• Cross-site scripting (XSS)

<6.2.0 · fixed in 6.2.0

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

• Denial of service

<5.16.8 || >=5.17.0, <5.17.7 || >=5.18.0, <5.18.7 || >=6.0.0, <6.1.6 · fixed in 5.16.8, 5.17.7, 5.18.7, 6.1.6

HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

• Cross-site scripting (XSS)

<3.7.11.Final · fixed in 3.7.11.Final

Liferay Portal Reflected XSS in marketplace-app-manager-web

• Cross-site scripting (XSS)

<5.0.50 · fixed in 5.0.50

Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

• Path traversal

<1.15.2 · fixed in 1.15.2

BRCC Incorrect Access Control vulnerability

• Broken access control

<=1.2.0 · no fixed version yet

WSO2 API Manager XML External Entity (XXE) vulnerability

• XML external entities (XXE)

<2.1.0 · fixed in 2.1.0

Elasticsearch Uncontrolled Resource Consumption Vulnerability

• Denial of service

<7.17.25 || >=8.0.0-alpha1, <8.16.0 · fixed in 7.17.25, 8.16.0

Keycloak vulnerable to two factor authentication bypass

• Authentication bypass

<26.2.2 · fixed in 26.2.2

Keycloak hostname verification

• Weak cryptography or TLS

<26.2.2 · fixed in 26.2.2

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

• Cross-site scripting (XSS)

>=8.2, <8.9 · fixed in 8.9

Any user with view access to the XWiki space can change the authenticator

• Broken access control

>=15.3-rc-1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1 · fixed in 15.10.14, 16.4.6, 16.10.0-rc-1

XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

• Broken access control

>=1.8.1, <14.10.22 || >=15.0-rc-1, <15.10.12 || >=16.0.0-rc-1, <16.4.3 || >=16.5.0-rc-1, <16.7.0 · fixed in 14.10.22, 15.10.12, 16.4.3, 16.7.0

Duplicate Advisory: Keycloak hostname verification

• Weak cryptography or TLS

<26.2.2 · fixed in 26.2.2

Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass

• Authentication bypass

<26.2.2 · fixed in 26.2.2

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

• Privilege escalation
• CWE-116

>=15.9-rc-1, <15.10.8 || >=16.0.0-rc-1, <16.2.0 · fixed in 15.10.8, 16.2.0

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

• Broken access control

>=15.9-rc-1, <15.10.12 || >=16.0.0-rc-1, <16.4.3 || >=16.5.0-rc-1, <16.8.0-rc-1 · fixed in 15.10.12, 16.4.3, 16.8.0-rc-1

The lesscss script service allows cache clearing without programming right

• Broken access control

>=6.1-milestone-1, <15.10.12 || >=16.0.0-rc-1, <16.4.3 || >=16.5.0-rc-1, <16.8.0-rc-1 · fixed in 15.10.12, 16.4.3, 16.8.0-rc-1

Solr script service doesn't take dropped programming right into account

• Broken access control

>=4.5.1, <15.10.13 || >=16.0.0-rc-1, <16.4.4 || >=16.5.0-rc-1, <16.8.0-rc-1 · fixed in 15.10.13, 16.4.4, 16.8.0-rc-1

org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability

• Open redirect

>=13.5-rc-1, <15.10.13 || >=16.0.0-rc-1, <16.4.4 || >=16.5.0-rc-1, <16.8.0 · fixed in 15.10.13, 16.4.4, 16.8.0

Apache Tomcat Rewrite rule bypass

• CWE-116
• CWE-150

>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100 · fixed in 9.0.104, 10.1.40, 11.0.6

Apache Tomcat Denial of Service via invalid HTTP priority header

• CWE-459
• CWE-460

>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100 · fixed in 9.0.104, 10.1.40, 11.0.6

Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

• Broken access control
• CWE-20

<=2.7.24.2 || >=3.1.0, <=3.1.15.2 || >=3.2.0, <=3.2.13.2 || >=3.3.0, <3.3.11 || >=3.4.0, <3.4.5 · fixed in 3.3.11, 3.4.5

Apereo CAS has inefficient regular expression complexity

• Denial of service

<=5.2.6 · no fixed version yet

Apereo CAS has inefficient regular expression complexity

• Denial of service

<=5.2.6 · no fixed version yet

Apereo CAS code injection vulnerability

• Other injection
• Code injection

<=5.2.6 · no fixed version yet

Apache HttpClient disables domain checks

• Weak cryptography or TLS

>=5.4-alpha1, <5.4.3 · fixed in 5.4.3

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

• SQL injection

>=1.8, <15.10.16 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.1 · fixed in 15.10.16, 16.4.6, 16.10.1

org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

• SQL injection

>=1.6-milestone-1, <15.10.16 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.1 · fixed in 15.10.16, 16.4.6, 16.10.1

XSS in the /download Endpoint of the JPA Web API

• Cross-site scripting (XSS)

<1.1.1 · fixed in 1.1.1

XSS in the /files Endpoint of the Generic REST API

• Cross-site scripting (XSS)

<7.2.7 · fixed in 7.2.7

Cuba has a DoS in the File Storage

• Denial of service

<7.2.23 · fixed in 7.2.23

io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage

• Denial of service

>=1.0.0, <1.6.2 || >=2.0.0, <2.4.0 · fixed in 1.6.2, 2.4.0

io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API

• Cross-site scripting (XSS)

>=1.0.0, <1.6.2 || >=2.0.0, <2.4.0 · fixed in 1.6.2, 2.4.0

io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage

• Path traversal

>=1.0.0, <1.6.2 || >=2.0.0, <2.4.0 · fixed in 1.6.2, 2.4.0

OpenCMS Cross-Site Scripting vulnerability

• Cross-site scripting (XSS)

<=17.0 · no fixed version yet

MCMS allows arbitrary file uploads in the ueditor component

• Unrestricted file upload

<5.4.4 · fixed in 5.4.4

OpenCMS cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<=17.0 · no fixed version yet

Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<=17.0 · no fixed version yet

OpenMetadata SQL Injection

• SQL injection

<=1.4.1 · no fixed version yet

Liferay Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=7.2.10.fp1, <=7.2.10.fp20 || >=7.3.10.ep1, <=7.3.10.u36 || >=7.4.13.u1, <=7.4.13.u92 || >=2023.Q3.1, <=2023.Q3.10 || >=2023.Q4.0, <=2023.Q4.10 || >=2024.Q1.1, <2024.Q1.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q3.1, <2024.Q3.10 || >=2024.Q4.1, <2025.Q1.0 || >=7.2.10, <=7.2.10.8 || >=7.3.10.0, <=7.3.10.3 · fixed in 2024.Q1.13, 2024.Q3.10, 2025.Q1.0

Unregistered users can see "public" messages from a closed wiki via notifications from a different wiki

• Information disclosure

>=5.0, <=16.7.1 · no fixed version yet

jsonschema2pojo has Improper Restriction of Operations within the Bounds of a Memory Buffer

• Memory corruption

<=1.2.2 · no fixed version yet

Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File

• Information disclosure

>=1.5.1, <2.40.0 · fixed in 2.40.0

Apache Pulsar Kafka Connector Logs Sensitive Information in Application Logs

• Information disclosure

<3.0.11 || >=3.3.0, <3.3.6 || >=4.0.0, <4.0.4 · fixed in 3.0.11, 3.3.6, 4.0.4

Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing

• CWE-20

<5.4.0 · fixed in 5.4.0

Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion

• Denial of service

>=7.17.0, <7.17.24 || >=8.0.0-alpha1, <8.15.1 · fixed in 7.17.24, 8.15.1

Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function

• Denial of service

>=7.17.0, <8.15.1 · fixed in 8.15.1

Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

• Broken access control

>=6.1.0, <6.1.9 · fixed in 6.1.9

The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server

• XML external entities (XXE)

>=4.2, <8.5.6 · fixed in 8.5.6

Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component

• SQL injection

<=3.5.1 · no fixed version yet

Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted

• Information disclosure
• CWE-256

<4.0.1 · fixed in 4.0.1

Jenkins Missing Permission Check

• Broken access control

>=2.500, <2.504 || <2.492.3 · fixed in 2.504, 2.492.3

Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form

• Weak cryptography or TLS
• CWE-549

<=0.1.1 · no fixed version yet

Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

• Cross-site request forgery (CSRF)

<1.4.7 · fixed in 1.4.7

Jenkins monitor-remote-job Plugin Stores Passwords Unencrypted

• Broken access control
• Information disclosure

=1.0 · no fixed version yet

Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files

• Information disclosure
• CWE-549

<=0.1.1 · no fixed version yet

Jenkins Missing Permission Check

• Broken access control

>=2.500, <2.504 || <2.492.3 · fixed in 2.504, 2.492.3