Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 9.3 CriticalCritical · CVSS 9+
XWiki configuration files can be accessed through the webjars API
- Path traversal
>=6.1-miletone-2, <=7.1.3 · no fixed version yet
GHSA-qww7-89xh-x7m7 · CVE-2025-55747 - CVSS 4.3 Medium
Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated
- Broken access control
<347.v32a · fixed in 347.v32a
GHSA-gm8g-fh49-qq6v · CVE-2025-58459 - CVSS 4.3 Medium
Jenkins Git client Plugin file system information disclosure vulnerability
- Information disclosure
<6.3.3 · fixed in 6.3.3
GHSA-g2pq-9jr7-w6gv · CVE-2025-58458 - CVSS 4.2 Medium
Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials
- Broken access control
<3.1543.1545.vf5a · fixed in 3.1543.1545.vf5a
GHSA-f696-867g-2759 · CVE-2025-58460 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache DolphinScheduler Incorrect Default Permissions Vulnerability
- Broken access control
<3.3.1 · fixed in 3.3.1
GHSA-rrpj-r8h7-rm7r · CVE-2024-43166 - CVSS 6.5 Medium
Silverpeas Core Username Enumeration Vulnerability
- CWE-20
- CWE-204
>=6.4.1, <6.4.3 · fixed in 6.4.3
GHSA-cv2m-5pfp-f245 · CVE-2025-46047 - CVSS 7.5 High
Undertow MadeYouReset HTTP/2 DDoS Vulnerability
- Denial of service
<2.2.38.Final || >=2.3.0.Alpha1, <2.3.20.Final · fixed in 2.2.38.Final, 2.3.20.Final
GHSA-95h4-w6j8-2rp8 · CVE-2025-9784 - CVSS 4.6 Medium
Liferay Portal allows improper access through the expandoTableLocalService
- Broken access control
<6.0.93 · fixed in 6.0.93
GHSA-876g-49r6-33qj · CVE-2025-43773 - CVSS 2.7 Low
Opencast has a partial path traversal vulnerability in UI config
- Path traversal
<17.7 || >=18.0, <18.1 · fixed in 17.7, 18.1
GHSA-hq8m-v68g-8cf8 · CVE-2025-55202 - CVSS 9.1 CriticalCritical · CVSS 9+
Valtimo scripting engine can be used to gain access to sensitive data or resources
- Command injection
- Information disclosure
<12.16.0.RELEASE || >=13.0.0.RELEASE, <13.1.2.RELEASE · fixed in 12.16.0.RELEASE, 13.1.2.RELEASE
GHSA-w48j-pp7j-fj55 · CVE-2025-58059 - CVSS 5.8 Medium
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
- CWE-212
- CWE-257
>=14.4.2, <16.4.8 || >=16.5.0-rc-1, <16.10.7 || >=17.0.0-rc-1, <17.4.0-rc-1 · fixed in 16.4.8, 16.10.7, 17.4.0-rc-1
GHSA-9m7c-m33f-3429 · CVE-2025-58049 - CVSS 8.8 High
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
- Privilege escalation
>=4.0.16, <4.0.17 · fixed in 4.0.17
GHSA-5c4f-pxmx-xcm4 · CVE-2025-26467 - CVSS 6.8 Medium
Liferay Portal allows unrestricted upload of file in the style books component
- Unrestricted file upload
<2.0.117 · fixed in 2.0.117
GHSA-mf9q-87xx-jgvv · CVE-2025-43766 - CVSS 6.9 Medium
Liferay Portal stored cross-site scripting in text field of the web content structure
- Cross-site scripting (XSS)
<7.0.161 · fixed in 7.0.161
GHSA-h8gx-4hhm-w45v · CVE-2025-43765 - CVSS 5.1 Medium
Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect
- Open redirect
<5.0.69 · fixed in 5.0.69
GHSA-6hj4-v2qp-cqr2 · CVE-2025-43767 - CVSS 6.9 Medium
Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet
- Denial of service
<5.0.145 · fixed in 5.0.145
GHSA-23w4-rpc6-wpcc · CVE-2025-43764 - CVSS 4.6 Medium
Liferay Portal vulnerable to Stored XSS in Components portlet
- Cross-site scripting (XSS)
<5.0.36 · fixed in 5.0.36
GHSA-rvmf-jw8g-r35r · CVE-2025-43769 - CVSS 6.9 Medium
Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter
- Cross-site scripting (XSS)
<155.0.0 · fixed in 155.0.0
GHSA-h4m4-xp33-37mj · CVE-2025-43770 - CVSS 5.1 Medium
Liferay Portal JSONWS API endpoint shares sensitive information
- Information disclosure
<108.1.1 · fixed in 108.1.1
GHSA-cv9j-mg9w-v7wm · CVE-2025-43768 - CVSS 6.7 Medium
Liferay Portal users are able to add system admin portlets to pages
- Broken access control
<6.0.147 · fixed in 6.0.147
GHSA-w3cr-3xw2-rp78 · CVE-2025-43759 - CVSS 5.3 Medium
Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry
- Information disclosure
<5.0.125 · fixed in 5.0.125
GHSA-mm62-gwj5-j285 · CVE-2025-43758 - CVSS 5.3 Medium
Liferay Portal users can upload an unlimited amount of files
- Denial of service
<6.0.187 · fixed in 6.0.187
GHSA-84pp-qr92-95c9 · CVE-2025-43762 - CVSS 6.9 Medium
Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint
- Cross-site scripting (XSS)
<5.0.107 · fixed in 5.0.107
GHSA-3h7r-4xxj-3mfm · CVE-2025-43761 - CVSS 5.3 Medium
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect
- Cross-site scripting (XSS)
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-fvqv-593q-qp8r · CVE-2025-43760 - CVSS 6.9 Medium
Liferay Portal User Enumeration Vulnerability via the Create Account Page
- Information disclosure
<6.0.66 · fixed in 6.0.66
GHSA-xwc5-q44v-p6gg · CVE-2025-43751 - CVSS 6.5 Medium
JeecgBoot SQL Injection Vulnerability
- SQL injection
>=3.4.3, <3.8.1 · fixed in 3.8.1
GHSA-gj8w-ffq9-6828 · CVE-2025-51825 - CVSS 0.0 None
Bouncy Castle for Java has Out-of-Bounds Write Vulnerability
- Memory corruption
>=2.1.0, <2.1.1 · fixed in 2.1.1
GHSA-g6rx-6wfx-gj74 · CVE-2025-9340 - CVSS 5.9 Medium
Bouncy Castle for Java has Uncontrolled Resource Consumption Vulnerability
- Denial of service
>=2.1.0, <2.1.1 · fixed in 2.1.1
GHSA-jfcv-jv9g-2vx2 · CVE-2025-9341 - CVSS 5.3 Medium
Liferay Portal's Unlimited File Upload Could Result in DoS
- Denial of service
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-qpp6-f3qj-rggq · CVE-2025-43752 - CVSS 2.1 Low
Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container
- Cross-site scripting (XSS)
<16.1.32 · fixed in 16.1.32
GHSA-r367-q549-pgr5 · CVE-2025-43753 - CVSS 8.8 High
hippo4j Includes Hard Coded Secret Key in JWT Creation
- Hard-coded credentials
>=1.0.0, <=1.5.0 · no fixed version yet
GHSA-48cg-9c55-j2q7 · CVE-2025-51606 - CVSS 6.9 Medium
Liferay Portal Username Enumeration Vulnerability
- CWE-208
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-x7p4-v8mj-6fxx · CVE-2025-43754 - CVSS 6.9 Medium
Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter
- Cross-site scripting (XSS)
=7.4.3.132-ga132 · no fixed version yet
GHSA-q2gv-w583-f2vq · CVE-2025-43756 - CVSS 5.1 Medium
Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter
- Cross-site scripting (XSS)
<5.0.191 · fixed in 5.0.191
GHSA-58cq-8wm2-6m87 · CVE-2025-43755 - CVSS 4.9 Medium
Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services
- CWE-526
<=26.3.3 · no fixed version yet
GHSA-w2wj-hw98-233h - CVSS 5.3 Medium
xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter
- Broken access control
- CWE-99
<3.2.0 · fixed in 3.2.0
GHSA-gjx6-h8hm-c9rq · CVE-2025-9264 - CVSS 5.3 Medium
xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key
- Broken access control
- CWE-99
<3.2.0 · fixed in 3.2.0
GHSA-6rq7-m52p-8pqg · CVE-2025-9263 - CVSS 8.4 HighCritical · CVSS 7+ and EPSS
Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF
- XML external entities (XXE)
>=1.13, <3.2.2 · fixed in 3.2.2
GHSA-p72g-pv48-7w9x · CVE-2025-54988 - CVSS 5.1 Medium
Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping
- Cross-site scripting (XSS)
<5.0.122 · fixed in 5.0.122
GHSA-mpww-r37c-vxjw · CVE-2025-43746 - CVSS 4.8 Medium
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter
- Cross-site scripting (XSS)
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-62pf-hcwj-rcfc · CVE-2025-43757 - CVSS 7.7 High
Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
- Denial of service
>=9.3.0, <9.4.58 || >=10.0.0, <10.0.26 || >=11.0.0, <11.0.26 · fixed in 9.4.58, 10.0.26, 11.0.26
GHSA-mmxm-8w33-wc4h · CVE-2025-5115 - CVSS 7.1 High
Liferay Portal Vulnerable to Cross-Site Request Forgery
- Cross-site request forgery (CSRF)
>=7.0.0-a1, <7.4.3.120-ga120 · fixed in 7.4.3.120-ga120
GHSA-p9gc-59hf-x48p · CVE-2025-43748 - CVSS 5.3 Medium
Liferay Portal Unauthenticated File Access via URL
- Information disclosure
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-5fx5-cff6-f3fp · CVE-2025-43749 - CVSS 5.1 Medium
Liferay Portal Unvalidated File Upload
- Unrestricted file upload
<4.0.180 · fixed in 4.0.180
GHSA-56qj-wp5r-mvhj · CVE-2025-43750 - CVSS 5.1 Medium
Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter
- Cross-site scripting (XSS)
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-j6p8-g3rj-ghpm · CVE-2025-43741 - CVSS 6.9 Medium
Liferay Portal Vulnerable to Cross-Site Scripting through URLs
- Cross-site scripting (XSS)
<3.0.59 · fixed in 3.0.59
GHSA-3fp2-6mwq-4q3j · CVE-2025-43742 - CVSS 6.3 Medium
Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java
- Server-side request forgery (SSRF)
>=1.6.0-release, <=1.11.0-release · no fixed version yet
GHSA-hf86-8x8v-h7vc · CVE-2024-39954 - CVSS 5.1 Medium
Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels
- Cross-site scripting (XSS)
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-m49p-6cjp-x2h3 · CVE-2025-43744 - CVSS 5.3 Medium
Liferay Portal Enumeration Discrepancy in Calendars
- Information disclosure
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-g4vp-4gqr-7v8c · CVE-2025-43743 - CVSS 5.1 Medium
Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter
- Cross-site scripting (XSS)
<5.0.196 · fixed in 5.0.196
GHSA-vjwr-cqwf-6q96 · CVE-2025-43737 - CVSS 6.9 Medium
Liferay Portal CSRF Vulnerability via Endpoint Parameter
- Cross-site request forgery (CSRF)
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-7q33-gwcm-r6cj · CVE-2025-43745 - CVSS 5.1 Medium
Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter
- Cross-site scripting (XSS)
<=5.0.59 · no fixed version yet
GHSA-cwgh-r52j-xh6c · CVE-2025-43738 - CVSS 5.3 Medium
Liferay Portal Email Modification Vulnerability via Calendar Portlet
- Information disclosure
<6.0.83 · fixed in 6.0.83
GHSA-7mxq-h2r7-h449 · CVE-2025-43739 - CVSS 4.6 Medium
Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature
- Cross-site scripting (XSS)
>=7.4.3.120-ga120, <=7.4.3.132-ga23 · no fixed version yet
GHSA-22jp-w3cg-gvmm · CVE-2025-43740 - CVSS 6.9 Medium
Liferay Portal Vulnerable to Cross-Site Scripting
- Cross-site scripting (XSS)
>=7.4.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-3p2m-574v-v257 · CVE-2025-43731 - CVSS 2.0 Low
Liferay Portal Login Bypass Vulnerability
- Authentication bypass
>=7.3.0-ga1, <=7.4.3.132-ga132 · no fixed version yet
GHSA-g4wg-mpfg-x2q6 · CVE-2025-3639 - CVSS 2.3 Low
Liferay Portal Vulnerable to Cross-Site Scripting
- Cross-site scripting (XSS)
<17.0.0 · fixed in 17.0.0
GHSA-vhcr-hgc8-29qr · CVE-2025-43733 - CVSS 4.8 Medium
Liferay Portal Vulnerable to Insecure Direct Object Reference
- Broken access control
<5.0.32 · fixed in 5.0.32
GHSA-v6xr-v2qg-h22h · CVE-2025-43732 - CVSS 5.9 Medium
Spring Framework MVC Applications Path Traversal Vulnerability
- Path traversal
>=6.2.0, <6.2.10 || >=6.1.0, <=6.1.21 || >=6.0.0, <=6.0.29 || >=5.3.0, <=5.3.43 · fixed in 6.2.10
GHSA-r936-gwx5-v52f · CVE-2025-41242 - CVSS 1.0 Low
Bouncy Castle for Java Uncontrolled Resource Consumption Vulnerability
- Denial of service
>=2.1.0, <2.1.1 · fixed in 2.1.1
GHSA-v6cf-mv9h-c8mc · CVE-2025-9092