Maven Advisories.

Jenkins is missing a permission check on password fields

• Broken access control

>=2.529, <2.541 || <2.528.3 · fixed in 2.541, 2.528.3

Jenkins's build authorization token is stored and displayed in plain text

• Information disclosure

>=2.529, <2.541 || <2.528.3 · fixed in 2.541, 2.528.3

Jenkins's build authorization token is stored and displayed in plain text

• Information disclosure

>=2.529, <2.541 || <2.528.3 · fixed in 2.541, 2.528.3

Jenkins has a Denial of service vulnerability in HTTP-based CLI

• Denial of service

>=2.529, <2.541 || <2.528.3 · fixed in 2.541, 2.528.3

Jenkins has a CSRF vulnerability on the login form

• Cross-site request forgery (CSRF)

>=2.529, <2.541 || <2.528.3 · fixed in 2.541, 2.528.3

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

• Code injection

<16.10.10 || >=17.0.0-rc-1, <17.4.3 || >=17.5.0-rc-1, <17.6.0-rc-1 · fixed in 16.10.10, 17.4.3, 17.6.0-rc-1

XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

• Denial of service

<16.10.11 || >=17.0.0-rc-1, <17.4.4 || >=17.5.0-rc-1, <17.7.0-rc-1 · fixed in 16.10.11, 17.4.4, 17.7.0-rc-1

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

• Cross-site scripting (XSS)

>=6.2-milestone-1, <16.10.10 || >=17.0.0-rc-1, <17.4.2 · fixed in 16.10.10, 17.4.2

Apache Struts has a Denial of Service vulnerability

• CWE-459

>=2.0.0, <6.8.0 || >=7.0.0, <7.1.1 · fixed in 6.8.0, 7.1.1

Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

• Broken access control

<26.5.0 · fixed in 26.5.0

Robocode vulnerable to Directory Traversal in recursivelyDelete Method

• Path traversal

<1.9.5.6 · fixed in 1.9.5.6

Robocode has an insecure temporary file creation vulnerability in the AutoExtract component

• CWE-377

<1.9.5.6 · fixed in 1.9.5.6

JDA (Java Discord API) downloads external URLs when updating message components

• Server-side request forgery (SSRF)

>=6.0.0, <6.1.3 · fixed in 6.1.3

Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

• Information disclosure
• Broken access control

>=0.47.0, <0.49.1 · fixed in 0.49.1

yawkat LZ4 Java has a possible information leak in Java safe decompressor

• Information disclosure

<1.10.1 · fixed in 1.10.1

Apache Tika has XXE vulnerability

• XML external entities (XXE)

>=1.13, <3.2.2 · fixed in 3.2.2

Central Dogma's Login Function Has an Open Redirect Vulnerability

• Open redirect

<0.78.0 · fixed in 0.78.0

Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

• CWE-20

<2.2.39.Final || >=2.4.0.Alpha1, <2.4.0.Beta1 || >=2.3.0.Alpha1, <2.3.21.Final · fixed in 2.2.39.Final, 2.4.0.Beta1, 2.3.21.Final

Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function

• Denial of service

<1.7.14.1 || >=1.7.15, <1.7.15.1 || >=1.8.0, <1.8.1 · fixed in 1.7.14.1, 1.7.15.1, 1.8.1

BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources

• Broken access control

<4.27 · fixed in 4.27

Keycloak unable to restrict access to the admin console

• CWE-427

<26.4.4 · fixed in 26.4.4

Keycloak has debug default bind address

• CWE-1327

<26.4.4 · fixed in 26.4.4

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

• CWE-703

>=3.0.0, <=6.10.1 · no fixed version yet

XWiki Jetty Package (XJetty) allows accessing any application file through URL

• Broken access control

>=16.7.0, <16.10.11 || >=17.0.0-rc-1, <17.4.4 || >=17.5.0, <17.7.0 · fixed in 16.10.11, 17.4.4, 17.7.0

Apache Struts is Vulnerable to DoS via File Leak

• CWE-459

>=6.0.0, <6.8.0 || >=7.0.0, <7.1.1 || >=2.0.0, <=2.3.37 || >=2.5.0, <=2.5.33 · fixed in 6.8.0, 7.1.1

NutzBoot vulnerable to information disclosure

• Information disclosure
• Broken access control

<=2.6.0-SNAPSHOT · no fixed version yet

NutzBoot vulnerable to deserialization

• Insecure deserialization
• CWE-20

<=2.6.0-SNAPSHOT · no fixed version yet

NutzBoot Incorrect Privilege Assignment vulnerability

• Privilege escalation
• Broken access control

<=2.6.0-SNAPSHOT · no fixed version yet

LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

• Memory corruption

<1.8.1 · fixed in 1.8.1

Mustangproject allows exfiltrating files via XXE attacks

• XML external entities (XXE)

<2.16.3 · fixed in 2.16.3

ThingsBoard allows an authenticated user to upload malicious SVG images

• Cross-site scripting (XSS)

<4.2.1 · fixed in 4.2.1

Apache SkyWalking has a stored XSS vulnerability

• Cross-site scripting (XSS)

<=10.1.0 · no fixed version yet

Hive Metastore Server is vulnerable to SQL Injection

• SQL injection

>=4.1.0, <4.2.0 · fixed in 4.2.0

Apache Druid’s Kerberos authenticator uses a weak fallback secret

• Weak cryptography or TLS

<35.0.0 · fixed in 35.0.0

OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

• Cross-site scripting (XSS)

>=20240325.1, <20260101.1 · fixed in 20260101.1

OpenSearch is vulnerable to DoS via complex query_string inputs

• Denial of service

>=3.0.0, <3.3.0 || <2.19.4 · fixed in 3.3.0, 2.19.4

GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

• XML external entities (XXE)

>=2.26.0, <2.26.2 || <2.25.6 · fixed in 2.26.2, 2.25.6

GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format

• Cross-site scripting (XSS)

<2.25.0 · fixed in 2.25.0

Duplicate Advisory: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

• Insecure deserialization

<26.4.6 · fixed in 26.4.6

Apache Syncope's AES encryption stores hard-coded passwords in internal database

• Hard-coded credentials

>=4.0.0, <4.0.3 || <3.0.15 · fixed in 4.0.3, 3.0.15

Resty has a Path Traversal vulnerability

• Path traversal

<=1.3.1.SNAPSHOT · no fixed version yet

Apache Causeway vulnerable to deserialization in Java

• Insecure deserialization

<3.5.0 · fixed in 3.5.0

XWiki view file macro: User can view content of office file without view rights on the attachment

• Broken access control

<1.27.0 · fixed in 1.27.0

Eclipse Jersey has a Race Condition

• Race condition
• CWE-296

>=2.45, <2.46 || >=3.0.16, <3.0.17 || >=3.1.9, <3.1.10 · fixed in 2.46, 3.0.17, 3.1.10

XWiki AdminTools application doesn't set permissions on the AdminTools space

• Broken access control

<1.1 · fixed in 1.1

lsFusion Platform has a Path Traversal vulnerability

• Path traversal

<=6.1 · no fixed version yet

vlife-base has Path Traversal vulnerability

• Path traversal

<=2.0.1 · no fixed version yet

lsFusion Server is vulnerable to Path Traversal through its unpackFile function

• Path traversal

<=6.0-beta2 · no fixed version yet

lsFusion Platform has a Path Traversal vulnerability

• Path traversal

<=6.1 · no fixed version yet

Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

• Code injection

<2.6.5 · fixed in 2.6.5

Duplicate Advisory: Keycloak allows Binding to an Unrestricted IP Address

• CWE-1327

<=26.4.4 · no fixed version yet

OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

• Other injection
• Code injection

<16.0.3 · fixed in 16.0.3

CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

• XML external entities (XXE)

>=2.1.0, <11.0.1 · fixed in 11.0.1

WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks

• XML external entities (XXE)

* · no fixed version yet

Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

• CWE-354
• CWE-693

>=4.0.0, <4.0.2 || <3.10.2 · fixed in 4.0.2, 3.10.2

Liferay Portal and DXP do not check permissions of images in a blog entry

• Broken access control

<6.0.19 · fixed in 6.0.19

Liferay Portal and DXP use an incorrect cache-control header

• CWE-525

<5.0.52 · fixed in 5.0.52

Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page

• Cross-site scripting (XSS)

<1.0.9 · fixed in 1.0.9

Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter

• Cross-site scripting (XSS)

>=7.4.3.8, <7.4.3.112-ga112 · fixed in 7.4.3.112-ga112

Liferay Portal is vulnerable to XSS in the Blogs widget

• Cross-site scripting (XSS)

>=7.4.0-ga1, <7.4.3.112-ga112 · fixed in 7.4.3.112-ga112