Maven Advisories.

Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

• Memory corruption

>=11.0.0-M1, <11.0.9 || >=10.1.0-M1, <10.1.43 || >=9.0.0.M1, <9.0.107 || >=8.5.0, <=8.5.100 · fixed in 11.0.9, 10.1.43, 9.0.107

Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector

• Race condition

>=9.0.0.M1, <9.0.107 || >=8.5.0, <=8.5.100 · fixed in 9.0.107

Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow

• CWE-346

<26.3.0 · fixed in 26.3.0

Jenkins User1st uTester Plugin vulnerability exposes unencrypted token to authenticated users

• Weak cryptography or TLS

<=1.1 · no fixed version yet

Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated users

• Information disclosure

<=1.16.5 · no fixed version yet

Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form

• Hard-coded credentials

<=1.16.5 · no fixed version yet

Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form

• Hard-coded credentials
• CWE-256

<=1.2.8 · no fixed version yet

Jenkins Xooa Plugin vulnerability exposes unencrypted tokens to authenticated users

• Weak cryptography or TLS

<=0.0.7 · no fixed version yet

Jenkins Warrior Framework Plugin vulnerability exposes unencrypted passwords to certain authenticated users

• CWE-256

<=1.2 · no fixed version yet

Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment Token

• CWE-256

<=0.0.7 · no fixed version yet

Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens

• CWE-256

<=1.0 · no fixed version yet

Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets

• Hard-coded credentials

<=1.11 · no fixed version yet

Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens

• Hard-coded credentials
• CWE-256

<=1.10 · no fixed version yet

Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens

• Weak cryptography or TLS
• Hard-coded credentials

<=2.0.16 · no fixed version yet

Jenkins QMetry Test Management Plugin stores unencrypted API keys

• Weak cryptography or TLS

<=1.13 · no fixed version yet

Jenkins VAddy Plugin vulnerability exposes unencrypted keys to certain authenticated users

• Weak cryptography or TLS

<=1.2.8 · no fixed version yet

Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokens

• Hard-coded credentials

<=0.1 · no fixed version yet

Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys

• Hard-coded credentials
• CWE-256

<=1.2 · no fixed version yet

Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page

• Cross-site scripting (XSS)

<1.16.6 · fixed in 1.16.6

Jenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API key

• Information disclosure

<=0.2 · no fixed version yet

Jenkins QMetry Test Management Plugin vulnerability exposes API keys

• Hard-coded credentials
• CWE-256

<=1.13 · no fixed version yet

Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens in its global configuration file

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Jenkins Testsigma Test Plan vulnerability exposes API keys via job configuration form

• Hard-coded credentials

<=1.6 · no fixed version yet

Jenkins ReadyAPI Functional Testing Plugin vulnerability stores unencrypted authentication credentials

• Hard-coded credentials
• CWE-256

<=1.11 · no fixed version yet

Jenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text

• Weak cryptography or TLS
• Hard-coded credentials

<=0.1 · no fixed version yet

Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form

• Hard-coded credentials
• CWE-256

<=1.08 · no fixed version yet

Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentials

• Information disclosure

<=1.08 · no fixed version yet

Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens

• Hard-coded credentials
• CWE-256

<=1.10 · no fixed version yet

Jenkins Statistics Gatherer Plugin does not mask AWS Secret Key

• CWE-256

<=2.0.3 · no fixed version yet

Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check

• CWE-20
• CWE-1287

<444.vca · fixed in 444.vca

Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens

• Weak cryptography or TLS
• Hard-coded credentials

<=3.2.8 · no fixed version yet

Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key

• Hard-coded credentials

<=2.0.3 · no fixed version yet

Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs

• Path traversal
• CWE-779

<427 · fixed in 427

Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages

• Hard-coded credentials
• CWE-779

<687.689.v1a · fixed in 687.689.v1a

Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

• CWE-1188

<=3.5.1 · no fixed version yet

junit-platform-reporting can leak Git credentials through its OpenTestReportGeneratingListener

• Information disclosure

>=5.12.0, <5.13.2 · fixed in 5.13.2

Graylog vulnerable to privilege escalation through API tokens

• Broken access control

>=6.2.0, <6.2.4 || >=6.3.0-alpha.1, <6.3.0-rc.2 · fixed in 6.2.4, 6.3.0-rc.2

Conductor vulnerable to OS command injection through unrestricted access to Java classes

• Command injection

<3.21.13 · fixed in 3.21.13

Janssen Config API returns results without scope verification

• Information disclosure
• Privilege escalation

<1.8.0 · fixed in 1.8.0

akka-cluster-metrics uses Java serialization for cluster metrics

• Insecure deserialization

<=2.10.6 · no fixed version yet

Apache Seata Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=2.0.0, <2.3.0 · fixed in 2.3.0

jackson-core can throw a StackoverflowError when processing deeply nested data

• Memory corruption

<2.15.0 · fixed in 2.15.0

Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information

• Information disclosure

<=16.0.0.Dev01 · no fixed version yet

XXL SSO is vulnerable to an Open Redirect through malicious manipulation of the redirect_url argument

• Open redirect

<=1.1.0 · no fixed version yet

Xuxueli XXL-SSO Cross-site Scripting vulnerability

• Cross-site scripting (XSS)
• Code injection

<=1.1.0 · no fixed version yet

Allure Report allows Improper XXE Restriction via DocumentBuilderFactory

• XML external entities (XXE)

<2.34.1 · fixed in 2.34.1

Quarkus potentially leaks data when duplicating a duplicated context

• Information disclosure

<3.15.6 || >=3.16.0.CR1, <3.20.2 || >=3.21.0.CR1, <3.24.1 · fixed in 3.15.6, 3.20.2, 3.24.1

sentry-android unmasked sensitive data in Android Session Replays for users of Jetpack Compose 1.8+

• Information disclosure

<8.14.0 · fixed in 8.14.0

Crafter Studio Groovy Sandbox Bypass

• CWE-913

>=4.0.0, <4.3.0 · fixed in 4.3.0

PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion

• Denial of service

>=5.0.0, <6.3.0 · fixed in 6.3.0

PowSyBl Core contains Polynomial REDoS’es

• Denial of service

<6.7.2 · fixed in 6.7.2

PowSyBl Core allows deserialization of untrusted SparseMatrix data

• Insecure deserialization

>=6.3.0, <6.7.2 · fixed in 6.7.2

PowSyBl Core XML Reader allows XXE and SSRF

• XML external entities (XXE)
• Server-side request forgery (SSRF)

<6.7.2 · fixed in 6.7.2

Apache SeaTunnel: Unauthenticated insecure access

• Authentication bypass

<2.3.11 · fixed in 2.3.11

Apache Tomcat - Security constraint bypass for pre/post-resources

• Authentication bypass

>=11.0.0-M1, <11.0.8 || >=10.1.0-M1, <10.1.42 || >=9.0.0.M1, <9.0.106 || >=8.5.0, <=8.5.100 · fixed in 11.0.8, 10.1.42, 9.0.106

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

• Denial of service

>=1.0, <1.6.0 · fixed in 1.6.0

Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler

• Path traversal

>=5.0.0, <5.0.24 || >=4.0.0, <4.0.48 || >=3.0.0, <3.0.67 || >=2.0.0, <2.0.66 || <1.0.93 · fixed in 5.0.24, 4.0.48, 3.0.67, 2.0.66, 1.0.93

Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session

• Denial of service

<38.0.0 · fixed in 38.0.0

Apache Tomcat - DoS in multipart upload

• Denial of service

>=11.0.0-M1, <11.0.8 || >=10.1.0-M1, <10.1.42 || >=9.0.0.M1, <9.0.106 || >=8.5.0, <=8.5.100 · fixed in 11.0.8, 10.1.42, 9.0.106

Apache Tomcat installer for Windows has an untrusted search path vulnerability

• CWE-426

>=11.0.0-M1, <11.0.8 || >=10.1.0, <10.1.42 || >=9.0.23, <9.0.106 · fixed in 11.0.8, 10.1.42, 9.0.106