Maven Advisories.

CSRF vulnerability in Jenkins Azure Service Fabric Plugin

• Cross-site request forgery (CSRF)

<=1.6 · no fixed version yet

Missing permission checks in Jenkins Azure Service Fabric Plugin

• Broken access control

<=1.6 · no fixed version yet

Disabled permissions can be granted by Folder-based in Jenkins Authorization Strategy Plugin

• Broken access control

<=217.vd5b · no fixed version yet

Incorrect permission check in Jenkins GitLab Plugin allows enumerating credentials IDs

• Broken access control

<1.9.7 · fixed in 1.9.7

Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

• Cross-site request forgery (CSRF)

>=2.1.0, <4.1.4 · fixed in 4.1.4

Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin

• Broken access control
• CWE-178

<4.453.v4d7765c854f4 · fixed in 4.453.v4d7765c854f4

Cache confusion in Jenkins Eiffel Broadcaster Plugin

• Broken access control

>=2.8.0, <2.10.3 · fixed in 2.10.3

Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

• Authentication bypass

<=26.1.0 · no fixed version yet

Apache Ranger UI vulnerable to Server Side Request Forgery

• Server-side request forgery (SSRF)
• CWE-20

>=0.5.0, <2.5.0 · fixed in 2.5.0

Apache Ranger has Stored Cross-site Scripting vulnerability in Edit Service Page

• Cross-site scripting (XSS)
• CWE-20

<2.5.0 · fixed in 2.5.0

Elasticsearch allocation of resources without limits or throttling leads to crash

• Denial of service

<7.17.21 || >=8.0.0, <8.13.3 · fixed in 7.17.21, 8.13.3

Apache CXF: Denial of Service vulnerability with temporary files

• Denial of service

<3.5.10 || >=3.6.0, <3.6.5 || >=4.0.0, <4.0.6 · fixed in 3.5.10, 3.6.5, 4.0.6

HAL Console has a Cross Site Scripting (XSS) vulnerability of user input

• Cross-site scripting (XSS)

<3.7.7.Final · fixed in 3.7.7.Final

Insecure Temporary File in RESTEasy

• CWE-378

>=6.0.0.Beta1, <6.2.3.Final || >=5.0.0.Alpha1, <5.0.6.Final || >=4.0.0.Beta1, <4.7.8.Final || <3.15.5.Final · fixed in 6.2.3.Final, 5.0.6.Final, 4.7.8.Final, 3.15.5.Final

Duplicate Advisory: Wildfly HAL Console Cross-Site Scripting

• Cross-site scripting (XSS)

<=3.7.7.Final · no fixed version yet

Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

• Information disclosure

>=1.5.0, <1.7.0 · fixed in 1.7.0

XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing

• Broken access control

>=13.9-rc-1, <15.10.12 || >=16.0.0-rc-1, <16.4.1 || >=16.5.0-rc-1, <16.6.0-rc-1 · fixed in 15.10.12, 16.4.1, 16.6.0-rc-1

Denial of Service in Keycloak Server via Security Headers

• CWE-693

<26.0.8 · fixed in 26.0.8

Keycloak allows unrestricted admin use of system and environment variables

• CWE-526

<26.0.8 · fixed in 26.0.8

jte's HTML templates containing Javascript template strings are subject to XSS

• Cross-site scripting (XSS)
• CWE-150

<3.1.16 · fixed in 3.1.16

Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=2.1.0, <8.0.0 · fixed in 8.0.0

Narayana deadlock via multiple join requests sent to LRA Coordinator

• Denial of service

<7.1.0.Final · fixed in 7.1.0.Final

Apache NiFi: Missing Complete Authorization for Parameter and Service References

• Broken access control
• CWE-638

>=1.10.0, <2.1.0 · fixed in 2.1.0

Amazon Redshift JDBC Driver vulnerable to SQL Injection

• SQL injection

>=2.1.0.31, <2.1.0.32 · fixed in 2.1.0.32

Apache MINA Deserialization RCE Vulnerability

• Code injection
• Insecure deserialization

>=2.2.0, <2.2.4 || >=2.1.0, <2.1.10 || >=2.0.0-M1, <2.0.27 · fixed in 2.2.4, 2.1.10, 2.0.27

Apache HugeGraph-Server: Fixed JWT Token (Secret)

• CWE-302

>=1.0.0, <1.5.0 · fixed in 1.5.0

Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment

• Cross-site scripting (XSS)
• CWE-1395

<3.7.7.Final · fixed in 3.7.7.Final

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

• Information disclosure

>=1.2.0, <4.0.0 · fixed in 4.0.0

Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

• Race condition

>=11.0.0-M1, <11.0.2 || >=10.1.0-M1, <10.1.34 || >=9.0.0.M1, <9.0.98 · fixed in 11.0.2, 10.1.34, 9.0.98

Spring Framework Path Traversal vulnerability

• Path traversal

>=6.1.0, <6.1.14 || <=5.3.40 || >=6.0.0, <=6.0.24 · fixed in 6.1.14

QOS.CH logback-core Expression Language Injection vulnerability

• Code injection

>=1.4.0, <1.5.13 || <1.3.15 · fixed in 1.5.13, 1.3.15

QOS.CH logback-core Server-Side Request Forgery vulnerability

• Server-side request forgery (SSRF)

>=1.4.0, <1.5.13 || <1.3.15 · fixed in 1.5.13, 1.3.15

Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm

• Authentication bypass

>=0.10.2.0, <=0.10.2.2 · no fixed version yet

Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page

• Cross-site scripting (XSS)

>=7.0, <7.3.10.u30 || >=7.4, <7.4.13.u88 · fixed in 7.3.10.u30, 7.4.13.u88

Duplicate Advisory: Keycloak vulnerable to Cleartext Transmission of Sensitive Information

• Weak cryptography or TLS

>=25.0.0, <26.0.6 · fixed in 26.0.6

Databricks JDBC Driver Command Injection vulnerability

• Command injection

>=2.0, <2.6.40 · fixed in 2.6.40

Elasticsearch Incorrect Authorization vulnerability

• Broken access control

>=8.16.0, <8.16.2 · fixed in 8.16.2

Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=7.1, <7.4.13.u39 · fixed in 7.4.13.u39

Apache Tomcat Uncontrolled Resource Consumption vulnerability

• Denial of service

>=11.0.0-M1, <11.0.2 || >=10.1.0-M1, <10.1.34 || >=9.0.0.M1, <9.0.98 · fixed in 11.0.2, 10.1.34, 9.0.98

Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

• Race condition

>=11.0.0-M1, <11.0.2 || >=10.1.0-M1, <10.1.34 || >=9.0.0.M1, <9.0.98 || >=8.5.0, <=8.5.100 · fixed in 11.0.2, 10.1.34, 9.0.98

Welcome and About GeoServer pages communicate version and revision information

• Information disclosure

>=2.0.0, <2.25.1 · fixed in 2.25.1

Ucum-java has an XXE vulnerability in XML parsing

• XML external entities (XXE)

<1.0.9 · fixed in 1.0.9

XWiki allows remote code execution through the extension sheet

• Code injection
• Broken access control

>=3.3-milestone-1, <15.10.9 || >=16.0.0-rc-1, <16.3.0 · fixed in 15.10.9, 16.3.0

XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

• CWE-116

>=6.3-milestone-2, <13.10.5 || >=14.0-rc-1, <14.3-rc-1 · fixed in 13.10.5, 14.3-rc-1

http4k has a potential XXE (XML External Entity Injection) vulnerability

• Information disclosure
• XML external entities (XXE)

<6.50.0.0 · fixed in 6.50.0.0

XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

• Broken access control

>=1.2-milestone-2, <15.10.9 || >=16.0.0-rc-1, <16.3.0 · fixed in 15.10.9, 16.3.0

XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

• Code injection

>=9.7-rc-1, <15.10.11 || >=16.0.0-rc-1, <16.4.1 || >=16.5.0-rc-1, <16.5.0 · fixed in 15.10.11, 16.4.1, 16.5.0

XWiki allows RCE from script right in configurable sections

• Broken access control

>=2.3, <15.10.9 || >=16.0.0-rc-1, <16.3.0 · fixed in 15.10.9, 16.3.0

Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse

• Information disclosure

<=2.3.18.Final · no fixed version yet

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

• HTTP request smuggling

<5.3.4 · fixed in 5.3.4

Apache Struts file upload logic is flawed

• Path traversal
• Unrestricted file upload

<6.4.0 · fixed in 6.4.0

Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack

• CWE-345

<=34.0.1.Final · no fixed version yet

sigstore-java has a vulnerability with bundle verification

• CWE-20

<1.2.0 · fixed in 1.2.0

Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore

• Insecure deserialization

>=4.0.0-alpha-1, <4.0.0-alpha-2 · fixed in 4.0.0-alpha-2

Spring LDAP data exposure vulnerability

• CWE-178

>=3.0.0, <3.2.8 || <2.4.4 · fixed in 3.2.8, 2.4.4

Apache Ozone: Improper authentication when generating S3 secrets

• Authentication bypass
• Broken access control

>=1.4.0, <1.4.1 · fixed in 1.4.1

AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

• Authentication bypass

>=2.1.0, <2.12.4 || >=3.0.0.Beta1, <3.0.1 · fixed in 2.12.4, 3.0.1

Withdrawn Advisory: Netty vulnerability included in redis lettuce

• Denial of service

<6.5.1.RELEASE · fixed in 6.5.1.RELEASE

veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

• XML external entities (XXE)

<1.26.2 · fixed in 1.26.2

Spring Framework has Authorization Bypass for Case Sensitive Comparisons

• Broken access control

<5.7.14 || >=5.8.0, <5.8.16 || >=6.0.0, <6.0.14 || >=6.1.0, <6.1.12 || >=6.2.0, <6.2.8 || >=6.3.0, <6.3.5 · fixed in 5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5