Maven Advisories.

Liferay Portal is vulnerable to DNS rebinding attacks

• Open redirect

>=7.4.0-ga1, <7.4.3.110 · fixed in 7.4.3.110

Liferay Portal vulnerable to password enumeration

• Authentication bypass

>=7.4.0-ga1, <7.4.3.120 · fixed in 7.4.3.120

Jenkins Publish to Bitbucket Plugin is missing a permissions check

• Broken access control

<=0.4 · no fixed version yet

Jenkins Publish to Bitbucket Plugin is missing a permissions check

• Broken access control

<=0.4 · no fixed version yet

Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check

• Cross-site request forgery (CSRF)

<=0.4 · no fixed version yet

Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery

• Cross-site request forgery (CSRF)

<=0.9.2 · no fixed version yet

Jenkins Eggplant Runner Plugin protection mechanism disabled

• CWE-1188

<=0.0.1.301.v963cffe8ddb · no fixed version yet

Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Jenkins Azure CLI Plugin does not restrict the commands it executes

• Command injection

<=0.9 · no fixed version yet

Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools

• Broken access control

<0.86.v7d3355e6a · fixed in 0.86.v7d3355e6a

Jenkins Start Windocks Containers Plugin is missing a permission check

• Broken access control

<=1.4 · no fixed version yet

Jenkins Themis Plugin is missing a permission check

• Broken access control

<=1.4.1 · no fixed version yet

Jenkins JDepend Plugin vulnerable to XML external entity attacks

• XML external entities (XXE)

<=1.3.1 · no fixed version yet

Jenkins SAML Plugin does not implement a replay cache

• Authentication bypass

<4.583.585.v22ccc1139f55 · fixed in 4.583.585.v22ccc1139f55

Jenkins Nexus Task Runner Plugin is missing a permission check

• Broken access control

<=0.9.2 · no fixed version yet

Jenkins Themis Plugin vulnerable to cross-site request forgery

• Cross-site request forgery (CSRF)

<=1.4.1 · no fixed version yet

Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery

• Cross-site request forgery (CSRF)

<=1.4 · no fixed version yet

Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files

• Weak cryptography or TLS

<=1.0.57 · no fixed version yet

Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

• Cross-site request forgery (CSRF)

<=239.v5f5c278708cf · no fixed version yet

Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files

• Weak cryptography or TLS

<=1.0 · no fixed version yet

Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files

• Weak cryptography or TLS

<=1.0 · no fixed version yet

InventoryGui allows item duplication in GUIs which use GuiStorageElement

• CWE-837

<1.6.5 · fixed in 1.6.5

Keycloak vulnerable to session takeovers due to reuse of session identifiers

• Authentication bypass

<26.0.0 · fixed in 26.0.0

Duplicate Advisory: Keycloak allows access to admin path through flaw

• CWE-427

<=26.4.2 · no fixed version yet

Liferay Portal Vulnerable to DoS via Crafted Headless API Request

• Denial of service

>=7.4.0-ga1, <7.4.3.100 · fixed in 7.4.3.100

Liferay Portal Does Not Limit Access to APIs Before Email Verification

• Broken access control

>=7.4.0-ga1, <7.4.3.110 · fixed in 7.4.3.110

Liferay Portal Vulnerable to CSRF in Headless APIs

• Cross-site request forgery (CSRF)

>=7.4.0-ga1, <7.4.3.108 · fixed in 7.4.3.108

Liferay Portal Stores Password Reset Tokens in Plain Text

• Information disclosure

<92.0.2 · fixed in 92.0.2

Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature

• Information disclosure

>=4.0.2, <4.0.54 · fixed in 4.0.54

Liferay Portal Vulnerable to Cross-Site Scripting

• Cross-site scripting (XSS)

>=2.0.0, <2.0.108 · fixed in 2.0.108

Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter

• Open redirect

>=5.0.8, <5.0.157 · fixed in 5.0.157

Keycloak TLS Client-Initiated Renegotiation Denial of Service

• Denial of service

<26.0.16 || >=26.1.0, <26.2.10 || >=26.3.0, <26.4.1 · fixed in 26.0.16, 26.2.10, 26.4.1

InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement

• CWE-837

<1.6.4-SNAPSHOT · fixed in 1.6.4-SNAPSHOT

InventoryGui affected by item duplication in GUIs which use GuiStorageElement

• CWE-754
• CWE-837

<1.6.2-SNAPSHOT · fixed in 1.6.2-SNAPSHOT

Apache Tomcat Vulnerable to Relative Path Traversal

• Path traversal

>=11.0.0-M1, <11.0.11 || >=10.1.0-M1, <10.1.45 || >=9.0.0-M11, <9.0.109 || >=8.5.6, <=8.5.100 · fixed in 11.0.11, 10.1.45, 9.0.109

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

• CWE-150

>=11.0.0-M1, <11.0.11 || >=10.1.0-M1, <10.1.45 || >=9.0.40, <9.0.109 || >=8.5.60, <=8.5.100 · fixed in 11.0.11, 10.1.45, 9.0.109

Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

• Denial of service

>=11.0.0-M1, <11.0.12 || >=10.1.0-M1, <10.1.47 || >=9.0.0.M1, <9.0.110 || >=8.5.0, <=8.5.100 · fixed in 11.0.12, 10.1.47, 9.0.110

Bouncy Castle Vulnerable to Uncontrolled Resource Consumption

• Denial of service

>=2.1.0, <2.1.2 · fixed in 2.1.2

Liferay Portal ComboServlet denial of service via large file combination

• Path traversal

<97.0.0 · fixed in 97.0.0

MCMS reflected cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<=6.0.1 · no fixed version yet

Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page

• Cross-site scripting (XSS)

<5.0.109 · fixed in 5.0.109

Liferay Portal and DXP do not properly restrict access to OpenAPI

• Broken access control

<6.0.26 · fixed in 6.0.26

Keycloak does not invalidate offline sessions when the offline_access scope is removed

• Authentication bypass

<26.2.3 · fixed in 26.2.3

Keycloak does not invalidate sessions when "Remember Me" is disabled

• Authentication bypass

>=26.3.0, <26.4.1 || <26.2.11 · fixed in 26.4.1, 26.2.11

Liferay Portal and DXP are Missing Authorization in Collection Provider

• Broken access control

<=3.0.84 · no fixed version yet

Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)

• Cross-site scripting (XSS)

<=5.0.122 · no fixed version yet

Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl

• CWE-337

<=23.3 · no fixed version yet

Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names

• Cross-site scripting (XSS)

<4.5.22 || >=5.0.0, <5.0.5 · fixed in 4.5.22, 5.0.5

Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories

• Information disclosure

<4.5.22 || >=5.0.0, <5.0.5 · fixed in 4.5.22, 5.0.5

Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget

• Cross-site scripting (XSS)

<=114.1.0 · no fixed version yet

Liferay Portal fails to verify messages from the cluster network is trusted

• CWE-346

<5.0.35 · fixed in 5.0.35

Apache Syncope allows malicious administrators to inject Groovy code

• CWE-653

<3.0.14 || >=4.0.0-M0, <4.0.2 · fixed in 3.0.14, 4.0.2

Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

• Cross-site request forgery (CSRF)

>=1.10.0, <1.15.2 · fixed in 1.15.2

MCMS vulnerable SQL injection via the content_title parameter

• SQL injection

>=5.5.0, <6.0.2 · fixed in 6.0.2

ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature

• Cross-site scripting (XSS)

<4.2.1 · fixed in 4.2.1

Keycloak error_description injection on error pages that can trigger phishing attacks

• Cross-site scripting (XSS)

<26.2.9 || >=26.3.0, <26.3.4 · fixed in 26.2.9, 26.3.4

Mammoth is vulnerable to Directory Traversal

• Path traversal

<1.11.0 · fixed in 1.11.0

Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

• Code injection

>=4.3.0, <4.3.2 || >=4.2.0, <4.2.6 || >=4.0.0, <=4.1.9 || <=3.1.10 · fixed in 4.3.2, 4.2.6

Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

• Cross-site request forgery (CSRF)

>=6.2.0, <6.2.12 || >=6.1.0, <=6.1.21 || >=6.0.0, <=6.0.23 || <=5.3.39 · fixed in 6.2.12