Maven Advisories.

GeoIP processor disables SSL certificate validation when downloading databases

• Weak cryptography or TLS

>=2.7.0, <2.12.2 · fixed in 2.12.2

OpenSearch Data Prepper uses deprecated SSL protocol identifier

• Weak cryptography or TLS

>=2.4.0, <2.12.2 · fixed in 2.12.2

OpenSearch Data Prepper plugins trust all SSL certificates by default

• Weak cryptography or TLS

<2.12.2 · fixed in 2.12.2

Netty has SMTP Command Injection Vulnerability that Allows Email Forgery

• Command injection
• Other injection

>=4.2.0.Alpha1, <4.2.7.Final || <4.1.128.Final · fixed in 4.2.7.Final, 4.1.128.Final

JDBC Driver for SQL Server has improper input validation issue

• CWE-20

>=8.3.0.jre11-preview, <10.2.4.jre11 || >=11.2.0.jre11, <11.2.4.jre11 || >=12.2.0.jre11, <12.2.1.jre11 || >=12.6.0.jre11, <12.6.5.jre11 || >=12.8.0.jre11, <12.8.2.jre11 || >=12.10.0.jre11, <12.10.2.jre11 || >=13.2.0.jre11, <13.2.1.jre11 · fixed in 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11

Apache Geode web-api is vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=1.1.0, <1.15.2 · fixed in 1.15.2

Liferay has Incorrect Permission Assignment for Critical Resource

• Broken access control

<1.0.23 · fixed in 1.0.23

Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key

• Broken access control

<99.0.0 · fixed in 99.0.0

Liferay Mentions Web is Vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<6.0.35 · fixed in 6.0.35

Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key

• Broken access control

<4.0.114 · fixed in 4.0.114

Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key

• Broken access control

<2.0.120 · fixed in 2.0.120

Liferay Publications is vulnerable to Incorrect Authorization

• Broken access control

<2.0.122 · fixed in 2.0.122

Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

• Broken access control

<2.0.122 · fixed in 2.0.122

Liferay Portal is vulnerable to CSRF through publication comments

• Cross-site request forgery (CSRF)

>=2.0.9, <2.0.121 · fixed in 2.0.121

PowerJob OpenAPIController is missing authorization

• Broken access control

<=5.1.2 · no fixed version yet

PowerJob has Missing Authorization in its /user/list file

• Broken access control

<=5.1.2 · no fixed version yet

Liferay Portal's Membership page is vulnerable to XSS through “name“ text field

• Cross-site scripting (XSS)

>=2.0.40, <2.0.114 · fixed in 2.0.114

Liferay Portal is vulnerable to XSS through its workflow process builder

• Cross-site scripting (XSS)

>=5.0.56, <5.0.124 · fixed in 5.0.124

Liferay Portal Commerce is vulnerable to XSS through account "name" field

• Cross-site scripting (XSS)

>=5.0.29, <5.0.101 · fixed in 5.0.101

Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability

• CWE-279

<=2.1.5 · no fixed version yet

Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

• Information disclosure

>=7.0.0, <8.18.8 || >=8.19.0, <8.19.5 || >=9.0.0-beta1, <9.0.8 || >=9.1.0, <9.1.5 · fixed in 8.18.8, 8.19.5, 9.0.8, 9.1.5

Liferay Portal is vulnerable to XSS through its Calendar Events parameters

• Cross-site scripting (XSS)

>=5.0.45, <5.0.88 · fixed in 5.0.88

Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

• SQL injection

>=3.0.0, <3.5.0 · fixed in 3.5.0

Keycloak Potential Variable Reference in Model Storage Services

• CWE-526

* || >=26.3.0, <26.3.4 · fixed in 26.3.4

Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting

• Cross-site scripting (XSS)

<=16.10 · no fixed version yet

Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields

• Cross-site scripting (XSS)

>=6.0.23, <6.0.24 · fixed in 6.0.24

Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file

• Cross-site scripting (XSS)

>=1.0.41, <1.0.83 · fixed in 1.0.83

Liferay Portal is vulnerable to Stored XSS through Forms text type field

• Cross-site scripting (XSS)

>=7.3.2, <7.4.3.112-ga112 · fixed in 7.4.3.112-ga112

Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field

• Cross-site scripting (XSS)

>=6.0.5, <6.0.134 · fixed in 6.0.134

Liferay Portal is vulnerable to XSS through its Commerce Search Result widget

• Cross-site scripting (XSS)

>=7.4.0, <7.4.3.112-ga112 · fixed in 7.4.3.112-ga112

Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page

• Cross-site scripting (XSS)

>=7.4.3.15, <7.4.3.112-ga112 · fixed in 7.4.3.112-ga112

Liferay Profile Widget does not prevent vCard extension spoofing

• Cross-site scripting (XSS)

>=7.4.0-ga1, <7.4.3.112-ga112 · fixed in 7.4.3.112-ga112

XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

• SQL injection

>=17.0.0-rc-1, <17.4.2 || >=4.3-milestone-1, <16.10.9 · fixed in 17.4.2, 16.10.9

XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

• Broken access control

>=2.17.1, <2.18.2 · fixed in 2.18.2

Liferay Portal exposes sensitive user data through its Freemarker template

• Information disclosure

>=7.0.3, <7.0.60 · fixed in 7.0.60

Apache Kylin Files or Directories Accessible to External Parties

• Information disclosure

>=4.0.0, <5.0.3 · fixed in 5.0.3

Apache Kylin Authentication Bypass Vulnerability

• Authentication bypass

>=4.0.0, <5.0.3 · fixed in 5.0.3

Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability

• Server-side request forgery (SSRF)

>=4.0.0, <5.0.3 · fixed in 5.0.3

QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing

• CWE-20

>=1.4.0, <1.5.19 || <1.3.16 · fixed in 1.5.19, 1.3.16

Liferay Portal Vulnerable to XSS in Web Content translation

• Cross-site scripting (XSS)

>=7.4.0-ga1, <7.4.3.113-ga113 · fixed in 7.4.3.113-ga113

Liferay Portal Vulnerable to IDOR via audit events

• Broken access control

>=6.0.4, <6.0.41 · fixed in 6.0.41

Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page

• Cross-site scripting (XSS)

>=6.0.80, <6.0.83 · fixed in 6.0.83

Liferay Portal vulnerable to cross-site scripting in the Calendar widget

• Cross-site scripting (XSS)

>=5.0.45, <5.0.88 · fixed in 5.0.88

Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter

• Cross-site scripting (XSS)

>=7.4.3.74-ga74, <7.4.3.112-ga112 · fixed in 7.4.3.112-ga112

Liferay Portal vulnerable to cross-site scripting in the web content template

• Cross-site scripting (XSS)

>=5.0.34, <5.0.161 · fixed in 5.0.161

Liferay Portal vulnerable to cross-site scripting in the Calendar widget

• Cross-site scripting (XSS)

>=5.0.45, <5.0.87 · fixed in 5.0.87

Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet

• Path traversal

<96.0.0 · fixed in 96.0.0

Liferay Portal vulnerable to cross-site scripting in the related asset selector

• Cross-site scripting (XSS)

>=7.0.35, <7.0.52 · fixed in 7.0.52

MinIO Java Client XML Tag Value Substitution Vulnerability

• Other injection
• Code injection

<8.6.0 · fixed in 8.6.0

WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled

• Information disclosure

<=7.8.103 · no fixed version yet

Hutool allows remote code execution (RCE) via the QLExpressEngine class

• Command injection
• Code injection

<5.8.40 · fixed in 5.8.40

Liferay Portal and DXP vulnerable to a memory leak

• Denial of service

<5.0.115 · fixed in 5.0.115

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

• CWE-280

>=3.9.0, <3.9.4 · fixed in 3.9.4

Apache IoTDB: DoS Vulnerability

• Denial of service
• CWE-20

>=1.3.3, <2.0.5 · fixed in 2.0.5

Liferay Portal and DXP does not properly expire sessions

• Authentication bypass

<5.0.51 · fixed in 5.0.51

WSO2 Identity Server Apps allows content spoofing in logs

• CWE-451

<2.4.4 · fixed in 2.4.4

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

• HTTP request smuggling

<0.23.31 · fixed in 0.23.31

WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<9.31.117 · fixed in 9.31.117

Liferay Portal and DXP does not properly check permission with import and export tasks

• Broken access control

<4.0.102 · fixed in 4.0.102

Liferay Portal and DXP audit events record password reminder answers

• Information disclosure

<5.0.13 · fixed in 5.0.13