Maven Advisories.

Liferay Portal does not limit the depth of a GraphQL queries

• Denial of service

<5.0.103 · fixed in 5.0.103

XWiki does not require right warnings for XClass definitions

• CWE-357

<15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2 · fixed in 15.10.16, 16.4.7, 16.10.2

XWiki allows remote code execution through preview of XClass changes in AWM editor

• Broken access control

>=7.2-milestone-2, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0 · fixed in 16.4.7, 16.10.3, 17.0.0

XWiki does not require right warnings for notification displayer objects

• CWE-357

>=15.9-rc-1, <15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2 · fixed in 15.10.16, 16.4.7, 16.10.2

XWiki makes title of inaccessible pages available through the class property values REST API

• Information disclosure

>=10.9, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0 · fixed in 16.4.7, 16.10.3, 17.0.0

XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

• Privilege escalation
• CWE-357

<15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2 · fixed in 15.10.16, 16.4.7, 16.10.2

XWiki allows remote code execution through default value of wiki macro wiki-type parameters

• Code injection
• Privilege escalation

>=11.10.11 || >=12.6.3 || >=12.8-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0 · fixed in 16.4.7, 16.10.3, 17.0.0

XWiki's required right warnings for macros are incomplete

• CWE-357

>=15.9-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0 · fixed in 16.4.7, 16.10.3, 17.0.0

XWiki allows privilege escalation through link refactoring

• Privilege escalation

>=17.0.0-rc-1, <17.1.0-rc-1 || >=16.5.0-rc-1, <16.10.4 || >=8.2, <16.4.7 || >=7.4.5, <16.4.7 · fixed in 17.1.0-rc-1, 16.10.4, 16.4.7

Solon Vulnerable to Directory Traversal

• Path traversal
• Cross-site scripting (XSS)

>=3.1.2, <3.2.0 · fixed in 3.2.0

Spring Framework vulnerable to a reflected file download (RFD)

• Other injection

>=6.2.0, <6.2.8 || >=6.1.0, <6.1.21 || >=6.0.5, <=6.0.23 · fixed in 6.2.8, 6.1.21

XWiki allows SQL injection in query endpoint of REST API with Oracle

• SQL injection

>=1.0, <15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2 · fixed in 15.10.16, 16.4.7, 16.10.2

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

• Authentication bypass

>=42.7.4, <42.7.7 · fixed in 42.7.7

GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx

• Server-side request forgery (SSRF)

>=1.0.0, <2.24.4 || >=2.25.0, <2.25.2 · fixed in 2.24.4, 2.25.2

GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint

• XML external entities (XXE)
• Server-side request forgery (SSRF)

>=4.4.0, <4.4.8 || >=4.2.0, <4.2.13 · fixed in 4.4.8, 4.2.13

[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service

• XML external entities (XXE)
• Server-side request forgery (SSRF)

>=2.27.0, <2.27.1 || >=2.26.0, <2.26.3 || <2.25.7 · fixed in 2.27.1, 2.26.3, 2.25.7

GeoServer Infinite Loop Vulnerability in Jiffle process

• Denial of service

>=2.26.0, <2.26.3 || <2.25.7 · fixed in 2.26.3, 2.25.7

GeoServer Missing Authorization on REST API Index

• Broken access control

>=2.26.0, <2.26.3 || <2.25.6 · fixed in 2.26.3, 2.25.6

Coverage REST API Server Side Request Forgery

• Server-side request forgery (SSRF)

<2.26.0 · fixed in 2.26.0

GWC Home Page communicate version and revision information

• Information disclosure

>=2.26.0, <2.26.2 || <2.25.6 · fixed in 2.26.2, 2.25.6

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

• Information disclosure
• XML external entities (XXE)

<2.25.0 · fixed in 2.25.0

GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

• Server-side request forgery (SSRF)

>=2.0.0, <2.24.4 || >=2.25.0, <2.25.2 · fixed in 2.24.4, 2.25.2

Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability

• Server-side request forgery (SSRF)

>=3.1.0, <3.9.1 · fixed in 3.9.1

Apache Kafka Deserialization of Untrusted Data vulnerability

• Insecure deserialization

* · no fixed version yet

Apache Kafka Deserialization of Untrusted Data vulnerability

• Insecure deserialization

>=2.3.0, <=2.4.1 · no fixed version yet

GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling

• XML external entities (XXE)

>=33.0, <33.1 || >=32.0, <32.3 || >=29.0, <31.7 || <28.6.1 · fixed in 33.1, 32.3, 31.7, 28.6.1

Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

• Information disclosure

>=2.0.0, <2.13.0 · fixed in 2.13.0

Para Inserts Sensitive Information into Log File for Facebook authentication

• Information disclosure

<1.50.8 · fixed in 1.50.8

Jenkins Gatling Plugin Vulnerable to Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)

=136.vb · no fixed version yet

Apache InLong Deserialization of Untrusted Data Vulnerability

• Insecure deserialization

>=1.13.0, <2.1.0 · fixed in 2.1.0

Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language

• Code injection

<6.2.0.CR1 || >=7.0.0.Alpha1, <7.0.0.CR1 · fixed in 6.2.0.CR1, 7.0.0.CR1

Pekko Management may not properly apply authenticator when Basic Authentication is enabled

• Authentication bypass

<1.6.1 · fixed in 1.6.1

Erupt Unrestricted Upload of File with Dangerous Type vulnerability

• Unrestricted file upload

<=1.12.19 · no fixed version yet

WSO2 products vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<7.5.12 · fixed in 7.5.12

WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

• Open redirect

>=6.0.0, <7.0.111 || <5.25.707 · fixed in 7.0.111, 5.25.707

Para Server Logs Sensitive Information

• Information disclosure

<1.50.8 · fixed in 1.50.8

WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services

• Broken access control

>=2.0.0, <4.4.0 · fixed in 4.4.0

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

• HTTP request smuggling

>=4.2.0, <4.2.3 || >=4.1.0, <4.1.8 || >=4.0.0, <=4.0.9 || <3.1.10 · fixed in 4.2.3, 4.1.8, 3.1.10

Apache Tomcat - CGI security constraint bypass

• CWE-178

>=9.0.0.M1, <9.0.105 || >=10.1.0-M1, <10.1.41 || >=11.0.0-M1, <11.0.7 || >=8.5.0, <=8.5.100 · fixed in 9.0.105, 10.1.41, 11.0.7

Apache Commons Improper Access Control vulnerability

• Broken access control

>=1.0, <1.11.0 · fixed in 1.11.0

Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

• Broken access control

>=11.0.0.RELEASE, <=11.3.3.RELEASE || >=12.0.0.RELEASE, <12.13.0.RELEASE · fixed in 12.13.0.RELEASE

Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read

• Insecure deserialization

>=1.13.0, <2.2.0 · fixed in 2.2.0

Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass

• Insecure deserialization

>=1.13.0, <2.2.0 · fixed in 2.2.0

Apache InLong: JDBC Vulnerability during verification processing

• Insecure deserialization

>=1.13.0, <2.2.0 · fixed in 2.2.0

Fess has Insecure Temporary File Permissions

• Broken access control

<14.19.2 · fixed in 14.19.2

Eclipse JGit XML External Entity (XXE) Vulnerability

• XML external entities (XXE)

>=7.2.0.202503040940-r, <7.2.1.202505142326-r || >=7.1.0.202411261347-r, <7.1.1.202505221757-r || >=7.0.0.202409031743-r, <7.0.1.202505221510-r || >=6.1.0.202203080745-r, <6.10.1.202505221210-r || >=6.0.0.202110060947-m1, <6.0.0.202111291000-r || <5.13.4.202507202350-r · fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 6.10.1.202505221210-r, 6.0.0.202111291000-r, 5.13.4.202507202350-r

XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right

• Broken access control

>=16.10.0-rc-1, <16.10.4 || >=17.0.0-rc-1, <17.1.0-rc-1 · fixed in 16.10.4, 17.1.0-rc-1

Spring Security authorization bypass for method security annotations on private methods

• CWE-693

>=6.4.0, <6.4.6 · fixed in 6.4.6

Spring Framework DataBinder Case Sensitive Match Exception

• CWE-20

>=6.2.0, <6.2.7 || >=6.1.0, <6.1.20 || >=6.0.0, <=6.0.23 || <=5.3.39 · fixed in 6.2.7, 6.1.20

Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting

• Cross-site scripting (XSS)

<374.376.v3a_41a_a_142efe · fixed in 374.376.v3a_41a_a_142efe

Jenkins Cadence vManager Plugin is Missing Permission Checks

• Broken access control

<4.0.1-288.v8804b_ea_a_cb_7f · fixed in 4.0.1-288.v8804b_ea_a_cb_7f

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

• Broken access control

<111.v29fd614b_3617 · fixed in 111.v29fd614b_3617

Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

• Authentication bypass

<=1.0 · no fixed version yet

Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation

• CWE-20

<=2.7.3 · no fixed version yet

Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)

<4.0.1-288.v8804b_ea_a_cb_7f · fixed in 4.0.1-288.v8804b_ea_a_cb_7f

BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

• XML external entities (XXE)

>=1.0.0, <6.1.0 · fixed in 6.1.0

Apache IoTDB JDBC Driver Discloses Sensitive Information via Log Files

• Information disclosure

>=0.10.0, <1.3.4 || >=2.0.1-beta, <2.0.2 · fixed in 1.3.4, 2.0.2

Apache Commons Configuration Uncontrolled Resource Consumption

• Denial of service

<=1.10 · no fixed version yet

Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

• Denial of service

>=12.0.0, <12.0.17 · fixed in 12.0.17

**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request

• Denial of service

>=9.4.0, <9.4.57.v20241219 · fixed in 9.4.57.v20241219