Maven Advisories.

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

• Broken access control

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

• Broken access control

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

• Broken access control

<5.12.8 || >=5.13.0, <5.13.2 · fixed in 5.12.8, 5.13.2

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

• Broken access control

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

• Code injection

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Spring Framework Improper Path Limitation in XsltView

• Path traversal

<=5.2.25.RELEASE || >=5.3.0, <=5.3.49 || >=6.0.0, <=6.0.30 || >=6.1.0, <=6.1.28 || >=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

Spring Framework Server Sent Event stream corruption while rendering fragments

• Other injection

>=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

• Broken access control

>=5.2.5.RELEASE, <=5.2.25.RELEASE || >=5.3.0, <=5.3.49 || >=6.0.0, <=6.0.30 || >=6.1.0, <=6.1.28 || >=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

• CWE-1275

>=3.0.0.Beta1, <3.0.11 || >=2.0.0, <2.16.0 · fixed in 3.0.11, 2.16.0

IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

• Path traversal

<5.2.7 · fixed in 5.2.7

http4s has HTTP/2 Denial of Service with Ember Backend

• CWE-409

<0.23.35 · fixed in 0.23.35

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

• Broken access control

>=11.0.0-M1, <11.0.25 || >=10.1.0-M1, <10.1.58 || >=9.0.0-M1, <9.0.121 || >=8.5.0, <=8.5.100 || >=7.0.0, <=7.0.109 · fixed in 11.0.25, 10.1.58, 9.0.121

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

• Broken access control

>=11.0.0-M1, <11.0.25 || >=10.1.0-M1, <10.1.58 || >=9.0.0-M1, <9.0.121 || >=8.5.0, <=8.5.100 || >=7.0.0, <=7.0.109 · fixed in 11.0.25, 10.1.58, 9.0.121

Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

• CWE-20

>=11.0.20, <11.0.25 || >=10.1.53, <10.1.59 || >=9.0.115, <9.0.121 · fixed in 11.0.25, 10.1.59, 9.0.121

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

• Authentication bypass

>=11.0.0-M1, <11.0.25 || >=10.1.0-M1, <10.1.58 || >=9.0.0.M1, <9.0.121 || >=8.5.0, <=8.5.100 || >=7.0.30, <=7.0.109 · fixed in 11.0.25, 10.1.58, 9.0.121

Sakai Profile Image Deletion has an IDOR

• Broken access control

>=23.0, <23.5 || >=25.0, <=25.2 · fixed in 23.5

Sakai Conversations has a Stored XSS Issue

• Cross-site scripting (XSS)

>=23.0, <=23.3 · no fixed version yet

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

• CWE-20

>=4.11.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

• Other injection
• CWE-20

>=3.15.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

• CWE-20

>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

• Authentication bypass

>=4.8.0, <4.22.0 · fixed in 4.22.0

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

• Path traversal

>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

• CWE-20

>=2.17.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

• Path traversal

>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

• Path traversal

>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

• SQL injection

>=35.0, <35.1 || >=34.0, <34.5 || >=30.5, <33.6 · fixed in 35.1, 34.5, 33.6

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

• Denial of service

<0.0.23.Final · fixed in 0.0.23.Final

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

• Denial of service

<0.0.23.Final · fixed in 0.0.23.Final

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

• Denial of service

<0.0.23.Final · fixed in 0.0.23.Final

netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

• Memory corruption
• CWE-248

<0.0.23.Final · fixed in 0.0.23.Final

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

• Information disclosure

<0.0.23.Final · fixed in 0.0.23.Final

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

• CWE-664

<0.0.23.Final · fixed in 0.0.23.Final

jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations

• Denial of service

<1.23.2 · fixed in 1.23.2

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

• CWE-749

<2.27.0 · fixed in 2.27.0

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

• Broken access control

>=13.4-rc-1, <16.10.17 || >=17.0.0-rc-1, <17.4.10 || >=17.5.0-rc-1, <17.10.4 || >=18.0.0-rc-1, <18.1.0-rc-1 · fixed in 16.10.17, 17.4.10, 17.10.4, 18.1.0-rc-1

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

• CWE-640

>=26.0.0, <26.4.15 || >=26.5.0, <26.6.6 || >=26.7.0, <26.7.2 · fixed in 26.4.15, 26.6.6, 26.7.2

RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

• CWE-20

<5.33.0 · fixed in 5.33.0

RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

• Weak cryptography or TLS

<5.33.0 · fixed in 5.33.0

RabbitMQ Java client malformed body frame triggers raw command assembler exception

• CWE-20

<5.31.0 · fixed in 5.31.0

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

• Code injection

<5.33.0 · fixed in 5.33.0

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

• Denial of service

<5.33.1 · fixed in 5.33.1

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

• Denial of service

<5.33.1 · fixed in 5.33.1

Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

• Cross-site scripting (XSS)

<1.3.24 · fixed in 1.3.24

http4k: `DigestAuthProvider.verify` did not bind to request URI

• Authentication bypass

>=6.0.0.0, <6.50.0.0 || >=5.0.0.0, <5.42.0.0 || >=4.0.0.0, <4.51.0.0 · fixed in 6.50.0.0, 5.42.0.0, 4.51.0.0

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

• Weak cryptography or TLS

>=6.0.0.0, <6.50.0.0 || >=5.0.0.0, <5.42.0.0 || <=4.48.2.0 · fixed in 6.50.0.0, 5.42.0.0

docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

• Denial of service

<11.5.14 · fixed in 11.5.14

http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

• CWE-409

>=6.0.0.0, <6.49.0.0 || >=5.0.0.0, <5.42.0.0 || <=4.48.2.0 · fixed in 6.49.0.0, 5.42.0.0

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

• CWE-524

>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final · fixed in 4.2.17.Final, 4.1.137.Final

Netty: Memory Exhaustion in SctpMessageCompletionHandler

• Denial of service

>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final · fixed in 4.2.17.Final, 4.1.137.Final

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

• Code injection
• Insecure deserialization

<0.6.0 · fixed in 0.6.0

OpenAM Insecure SSO Cookie Initialization

• CWE-1004
• CWE-1188

<16.1.1 · fixed in 16.1.1

Apache Ranger has a Command Injection vulnerability

• Command injection

>=0.6.0, <=2.8.0 · no fixed version yet

Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound

• Denial of service

>=2.1.0, <2.1.3 · fixed in 2.1.3

Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.

• Denial of service

<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3 · fixed in 1.0.2.7, 2.0.2, 2.1.3

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

• Denial of service
• CWE-703

<4.1.136.Final || >=4.2.0-Final, <4.2.16.Final · fixed in 4.1.136.Final, 4.2.16.Final

jsoup: Cleaner may expose markup with custom raw-text elements

• Cross-site scripting (XSS)

>=1.14.3, <1.23.1 · fixed in 1.23.1

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow

• Denial of service

<0.35.0 · fixed in 0.35.0

Duplicate Advisory: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

• Denial of service

>=3.0.0 · no fixed version yet

Duplicate Advisory: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

• Denial of service

>=3.0.0, <3.1.0 || >=2.19.0, <2.21.1 || >=2.15.0, <2.18.6 · fixed in 3.1.0, 2.21.1, 2.18.6

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

• Denial of service

<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3 · fixed in 1.0.2.7, 2.0.2, 2.1.3