Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 3.7 Low
Jenkins Gogs Plugin uses non-constant time webhook token comparison
- CWE-208
- CWE-697
<=1.0.15 · no fixed version yet
GHSA-885r-hhpr-cc9p · CVE-2023-46657 - CVSS 3.7 Low
Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison
- CWE-208
- CWE-697
<=1.0.9 · no fixed version yet
GHSA-8859-v9jp-cphf · CVE-2023-46656 - CVSS 3.7 Low
Non-constant time webhook token hash comparison in Jenkins Zanata Plugin
- CWE-208
- CWE-697
<=0.6 · no fixed version yet
GHSA-86j9-25m2-9w97 · CVE-2023-46660 - CVSS 4.3 Medium
Jenkins Warnings Plugin exposures system-scoped credentials
- Information disclosure
- Hard-coded credentials
>=10.5.0, <10.5.1 || <10.4.1 · fixed in 10.5.1, 10.4.1
GHSA-66hv-fhcm-7xm7 · CVE-2023-46651 - CVSS 3.7 Low
Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison
- CWE-208
- CWE-697
<=0.1.1 · no fixed version yet
GHSA-2xpq-5952-38w3 · CVE-2023-46658 - CVSS 8.8 High
SaToken authentication bypass vulnerability
- Authentication bypass
- Broken access control
<1.36.0 · fixed in 1.36.0
GHSA-w9vh-hv5g-7wmr · CVE-2023-43961 -
Withdrawn Advisory: dom4j XML Entity Expansion vulnerability
- Denial of service
<=2.1.4 · no fixed version yet
GHSA-fgq9-fc3q-vqmw · CVE-2023-45960 - CVSS 9.8 CriticalCritical · CVSS 9+
SaToken privilege escalation vulnerability
- Broken access control
- CWE-281
<1.37.0 · fixed in 1.37.0
GHSA-54f6-9mx9-86f7 · CVE-2023-44794 - CVSS 5.9 Medium
light-oauth2 missing public key verification
- Weak cryptography or TLS
<2.1.27 · fixed in 2.1.27
GHSA-mx47-h5fv-ghwh · CVE-2023-31580 - CVSS 7.5 High
jose4j uses weak cryptographic algorithm
- Weak cryptography or TLS
- CWE-331
<0.9.3 · fixed in 0.9.3
GHSA-7g24-qg88-p43q · CVE-2023-31582 - CVSS 9.8 CriticalCritical · CVSS 9+
Sureness uses hardcoded key
- Hard-coded credentials
<1.0.8 · fixed in 1.0.8
GHSA-3j2f-58rq-g6p7 · CVE-2023-31581 - CVSS 8.6 HighCritical · CVSS 7+ and EPSS
WPS Server Side Request Forgery vulnerability
- Server-side request forgery (SSRF)
<2.22.5 || >=2.23.0, <2.23.2 · fixed in 2.22.5, 2.23.2
GHSA-5pr3-m5hm-9956 · CVE-2023-43795 - CVSS 8.6 High
Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF
- Server-side request forgery (SSRF)
<2.22.5 || >=2.23.0, <2.23.2 · fixed in 2.22.5, 2.23.2
GHSA-cqpc-x2c6-2gmf · CVE-2023-41339 - CVSS 3.9 Low
sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)
- Path traversal
>=1.0.0, <1.9.7 · fixed in 1.9.7
GHSA-h9mw-grgx-2fhf · CVE-2023-46122 - CVSS 4.9 Medium
RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack
- Denial of service
<5.18.0 · fixed in 5.18.0
GHSA-mm8h-8587-p46h · CVE-2023-46120 - CVSS 6.5 Medium
Apache Santuario - XML Security for Java are vulnerable to private key disclosure
- Information disclosure
>=2.3.0, <2.3.4 || <2.2.6 || >=3.0.0, <3.0.3 · fixed in 2.3.4, 2.2.6, 3.0.3
GHSA-xfrj-6vvc-3xm2 · CVE-2023-44483 - CVSS 5.4 Medium
Yamcs Cross-site Scripting vulnerability
- Cross-site scripting (XSS)
<5.8.7 · fixed in 5.8.7
GHSA-643f-hpcc-2gv8 · CVE-2023-45280 - CVSS 5.4 Medium
Yamcs Cross-site Scripting vulnerability
- Cross-site scripting (XSS)
<5.8.7 · fixed in 5.8.7
GHSA-4cqv-q33x-wfxw · CVE-2023-45279 - CVSS 7.5 High
Yamcs Path Traversal vulnerability
- Path traversal
<5.8.7 · fixed in 5.8.7
GHSA-w4m2-qmh3-2g8f · CVE-2023-45277 - CVSS 9.1 CriticalCritical · CVSS 9+
Yamcs API Directory Traversal vulnerability
- Path traversal
<5.8.7 · fixed in 5.8.7
GHSA-43fw-536j-w37j · CVE-2023-45278 - CVSS 7.5 High
Apache InLong Deserialization of Untrusted Data Vulnerability
- Insecure deserialization
>=1.4.0, <1.9.0 · fixed in 1.9.0
GHSA-jj32-3pf5-5mv5 · CVE-2023-46227 - CVSS 6.5 Medium
Apache Shenyu Server Side Request Forgery vulnerability
- Server-side request forgery (SSRF)
<2.6.0 · fixed in 2.6.0
GHSA-7w8v-5fcq-pvqw · CVE-2023-25753 - CVSS 8.3 High
MySQL Connectors takeover vulnerability
- Broken access control
<8.2.0 · fixed in 8.2.0
GHSA-m6vm-37g8-gqvh · CVE-2023-22102 - CVSS 9.6 CriticalCritical · CVSS 9+
Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module
- Cross-site scripting (XSS)
<4.0.35 · fixed in 4.0.35
GHSA-qp68-5v39-r869 · CVE-2023-42627 - CVSS 5.4 Medium
OpenSearch Issue with tenant read-only permissions
- CWE-281
>=2.0.0.0, <2.11.0.0 || <1.3.14.0 · fixed in 2.11.0.0, 1.3.14.0
GHSA-72q2-gwwf-6hrv · CVE-2023-45807 - CVSS 7.5 High
OpenSearch uncontrolled resource consumption
- Denial of service
<1.3.14.0 || >=2.0.0.0, <2.11.0.0 · fixed in 1.3.14.0, 2.11.0.0
GHSA-8wx3-324g-w4qq - CVSS 4.8 Medium
WebAuthn4J Spring Security Improper signature counter value handling
- Authentication bypass
<0.9.1.RELEASE · fixed in 0.9.1.RELEASE
GHSA-v9hx-v6vf-g36j · CVE-2023-45669 - CVSS 10.0 CriticalCritical · CVSS 9+
XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter
- Cross-site scripting (XSS)
- Code injection
>=1.0, <1.6 · fixed in 1.6
GHSA-h2rm-29ch-wfmh · CVE-2023-45144 - CVSS 9.0 CriticalCritical · CVSS 9+
Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu
- Cross-site scripting (XSS)
<6.0.102 · fixed in 6.0.102
GHSA-j5gv-w838-mmcx · CVE-2023-44310 - CVSS 9.0 CriticalCritical · CVSS 9+
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
- Cross-site scripting (XSS)
<7.0.95 · fixed in 7.0.95
GHSA-hv45-r2f5-fmhj · CVE-2023-42628 - CVSS 9.6 CriticalCritical · CVSS 9+
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
- Cross-site scripting (XSS)
<4.0.51 · fixed in 4.0.51
GHSA-49gm-5685-8fxv · CVE-2023-44311 - CVSS 9.6 CriticalCritical · CVSS 9+
Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page
- Cross-site scripting (XSS)
<2.0.86 · fixed in 2.0.86
GHSA-w2g3-j73q-7qv7 · CVE-2023-42497 - CVSS 9.0 CriticalCritical · CVSS 9+
Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components
- Cross-site scripting (XSS)
<3.0.25 · fixed in 3.0.25
GHSA-j663-6jpj-xx8c · CVE-2023-44309 - CVSS 9.0 CriticalCritical · CVSS 9+
Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page
- Cross-site scripting (XSS)
<5.0.87 · fixed in 5.0.87
GHSA-g44j-f8wm-6622 · CVE-2023-42629 - CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
XWiki Change Request Application UI XSS and remote code execution through change request title
- Cross-site scripting (XSS)
>=0.11, <1.9.2 · fixed in 1.9.2
GHSA-f776-w9v2-7vfj · CVE-2023-45138 - CVSS 6.5 Medium
Insufficient Verification of Data Authenticity in Apache InLong
- CWE-345
>=1.4.0, <1.9.0 · fixed in 1.9.0
GHSA-wj6q-chpv-mcrx · CVE-2023-43666 - CVSS 9.8 CriticalCritical · CVSS 9+
Authorization Bypass in Apache InLong
- Insecure deserialization
- Broken access control
>=1.4.0, <1.9.0 · fixed in 1.9.0
GHSA-rp6x-ggw6-8g56 · CVE-2023-43668 - CVSS 7.5 High
SQL Injection in Apache InLong
- Other injection
- SQL injection
>=1.4.0, <1.8.0 · fixed in 1.8.0
GHSA-fpcf-qr79-hjqp · CVE-2023-43667 - CVSS 7.5 High
Duplicate Advisory: Denial of Service in JSON-Java
- Denial of service
<20231013 · fixed in 20231013
GHSA-rm7j-f5g5-27vv - CVSS 9.1 CriticalCritical · CVSS 9+
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
- Broken access control
<3.7.2 || >=3.8.0, <3.8.3 || >=3.9.0, <3.9.1 · fixed in 3.7.2, 3.8.3, 3.9.1
GHSA-7286-pgfv-vxvh · CVE-2023-44981 - CVSS 7.5 High
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
- Denial of service
<4.1.100.Final · fixed in 4.1.100.Final
GHSA-xpw8-rcwv-8f8p - CVSS 5.3 Medium
Apache Tomcat Improper Input Validation vulnerability
- CWE-20
>=11.0.0-M1, <11.0.0-M12 || >=10.1.0-M1, <10.1.14 || >=9.0.0-M1, <9.0.81 || >=8.5.0, <8.5.94 · fixed in 11.0.0-M12, 10.1.14, 9.0.81, 8.5.94
GHSA-r6j3-px5g-cq3x · CVE-2023-45648 - CVSS 5.3 MediumCritical · KEVKEV
HTTP/2 Stream Cancellation Attack
- Denial of service
<0.17.0 · fixed in 0.17.0
GHSA-qppj-fm5r-hxr3 · CVE-2023-44487 - CVSS 7.5 High
HTTP/2 HPACK integer overflow and buffer allocation
- Memory corruption
- Denial of service
>=10.0.0, <10.0.16 || >=11.0.0, <11.0.16 || >=9.3.0, <9.4.53 · fixed in 10.0.16, 11.0.16, 9.4.53
GHSA-wgh7-54f2-x98r · CVE-2023-36478 - CVSS 5.9 Medium
Apache Tomcat Incomplete Cleanup vulnerability
- CWE-459
>=9.0.70, <9.0.81 || >=8.5.85, <8.5.94 · fixed in 9.0.81, 8.5.94
GHSA-jm7m-8jh6-29hp · CVE-2023-42794 - CVSS 5.3 Medium
Apache Tomcat Incomplete Cleanup vulnerability
- CWE-459
>=10.1.0-M1, <10.1.14 || >=9.0.0-M1, <9.0.81 || >=8.5.0, <8.5.94 || >=11.0.0-M1, <11.0.0-M12 · fixed in 10.1.14, 9.0.81, 8.5.94, 11.0.0-M12
GHSA-g8pj-r55q-5c2v · CVE-2023-42795 - CVSS 6.5 Medium
Microsoft Common Data Model SDK Denial of Service Vulnerability
- CWE-20
<1.7.4 · fixed in 1.7.4
GHSA-vm2m-7hpw-fpmq · CVE-2023-36566 - CVSS 6.3 Medium
Denial of service vulnerability on creating a Launch with too many recursively nested elements in reportportal
- Denial of service
<5.10.0 · fixed in 5.10.0
GHSA-mj24-gpw7-23m9 · CVE-2023-25822 - CVSS 6.1 Medium
mXSS in AntiSamy
- Cross-site scripting (XSS)
<1.7.4 · fixed in 1.7.4
GHSA-pcf2-gh6g-h5r2 · CVE-2023-43643 - CVSS 8.4 High
ThingsBoard Server-Side Template Injection
- Other injection
<3.5 · fixed in 3.5
GHSA-6pgr-j9v4-xfvv · CVE-2023-45303 - CVSS 4.8 Medium
io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud
- Broken access control
>=3.11.0, <3.11.1 || >=3.10.0, <3.10.2 || >=3.9.0, <3.9.6 || >=3.8.0, <3.8.4 || >=3.7.0, <3.7.4 || >=3.6.0, <3.6.6 || >=3.5.0, <3.5.3 || >=3.4.0, <3.4.3 || >=3.3.0, <3.3.2 || >=3.2.0, <3.2.4 || >=3.1.0, <3.1.2 · fixed in 3.11.1, 3.10.2, 3.9.6, 3.8.4, 3.7.4, 3.6.6, 3.5.3, 3.4.3, 3.3.2, 3.2.4, 3.1.2
GHSA-qw22-8w9r-864h · CVE-2023-36820 - CVSS 7.5 High
Quarkus OIDC can leak both ID and access tokens
- Information disclosure
<2.13.0.Final || >=3.0.0, <3.1.0.Final · fixed in 2.13.0.Final, 3.1.0.Final
GHSA-6hc9-cf8x-hf83 · CVE-2023-1584 - CVSS 7.4 High
Withdrawn Advisory: Netty-handler does not validate host names by default
- Weak cryptography or TLS
- CWE-20
>=4.1.0.Final, <=4.1.99.Final · no fixed version yet
GHSA-57m8-f3v5-hm5m · CVE-2023-4586 - CVSS 7.6 High
Presto JDBC Server-Side Request Forgery by nextUri
- Server-side request forgery (SSRF)
<=0.283 · no fixed version yet
GHSA-86q5-qcjc-7pv4 - CVSS 7.6 High
Presto JDBC Server-Side Request Forgery by redirect
- Server-side request forgery (SSRF)
<=0.283 · no fixed version yet
GHSA-xm7x-f3w2-4hjm - CVSS 7.5 High
Apache Avro Java SDK vulnerable to Improper Input Validation
- Insecure deserialization
- CWE-20
<1.11.3 · fixed in 1.11.3
GHSA-rhrv-645h-fjfh · CVE-2023-39410 - CVSS 7.5 High
Undertow vulnerable to denial of service
- Denial of service
<2.2.24.Final · fixed in 2.2.24.Final
GHSA-65h2-wf7m-q2v8 · CVE-2023-3223 - CVSS 4.3 Medium
codehaus-plexus vulnerable to XML injection
- Other injection
- XML external entities (XXE)
<3.0.24 · fixed in 3.0.24
GHSA-jcwr-x25h-x5fh · CVE-2022-4245 - CVSS 7.5 High
plexus-codehaus vulnerable to directory traversal
- Path traversal
<3.0.24 · fixed in 3.0.24
GHSA-g6ph-x5wf-g337 · CVE-2022-4244 - CVSS 7.5 High
snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact
- Denial of service
<1.1.10.4 · fixed in 1.1.10.4
GHSA-55g7-9cwv-5qfv · CVE-2023-43642