Maven Advisories.

Cross-Site Request Forgery with QueryOnXWiki allows arbitrary database queries

• Cross-site request forgery (CSRF)

<4.5.1 · fixed in 4.5.1

Run Shell Command allows Cross-Site Request Forgery

• Cross-site request forgery (CSRF)

>=4.4, <4.5.1 · fixed in 4.5.1

Whole content of all documents of all wikis exposed to anybody with view right on Solr suggest service

• Broken access control

>=6.3-milestone-2, <14.10.15 || >=15.0-rc-1, <15.5.1 · fixed in 14.10.15, 15.5.1

Cookies are sent to external images in rendered diff (and server side request forgery)

• Information disclosure
• Server-side request forgery (SSRF)

>=11.10.1, <14.10.15 || >=15.0-rc-1, <15.5.1 || >=15.6-rc-1, <15.6 · fixed in 14.10.15, 15.5.1, 15.6

Apache Derby: LDAP injection vulnerability in authenticator

• Other injection
• Code injection

>=10.1.1.0, <=10.1.3.1 || >=10.2.1.6, <=10.2.2.0 || >=10.3.1.4, <=10.3.3.0 || >=10.4.1.3, <=10.4.2.0 || >=10.5.1.1, <=10.5.3.0 || >=10.6.1.0, <=10.6.2.1 || >=10.8.1.2, <=10.8.3.0 || >=10.10.1.1, <=10.10.2.0 || >=10.14.2.0, <10.14.2.1 || >=10.16.1.1, <10.16.1.2 || >=10.15.1.3, <10.15.2.1 · fixed in 10.14.2.1, 10.16.1.2, 10.15.2.1

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)

<=5.2.0 · no fixed version yet

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)

<=5.2.0 · no fixed version yet

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)

<=5.2.0 · no fixed version yet

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)

<=5.2.0 · no fixed version yet

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)

<=5.2.0 · no fixed version yet

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)
• Code injection

<=5.2.0 · no fixed version yet

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)

<=5.2.0 · no fixed version yet

Cross-site Scripting in OpenCRX

• Cross-site scripting (XSS)

<=5.2.0 · no fixed version yet

Liferay Portal XSS with `p_l_back_url_title` on edit content page

• Cross-site scripting (XSS)

>=7.4.3.94, <7.4.3.96 · fixed in 7.4.3.96

OpenNMS Cross-site Scripting vulnerability

• Cross-site scripting (XSS)
• CWE-20

<32.0.5 · fixed in 32.0.5

Authenticated Rundeck users can view or delete jobs they do not have authorization for.

• Broken access control

>=4.12.0, <4.17.3 · fixed in 4.17.3

Authenticated users can view job names and groups they do not have authorization to view

• Broken access control

>=4.17.0, <4.17.3 · fixed in 4.17.3

H2O local file inclusion vulnerability

• Broken access control
• CWE-29

<=3.40.0.4 · no fixed version yet

Apache Hadoop allows local user to gain root privileges

• CWE-426

>=3.3.1, <3.3.5 · fixed in 3.3.5

xxl-job-admin vulnerable to Remote Code Execution

<=2.4.0 · no fixed version yet

Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain

• CWE-526

>=3.0.0.CR1, <=3.5.1 · no fixed version yet

Zip slip in mleap

• Path traversal

<0.23.1 · fixed in 0.23.1

xxl-job-admin vulnerable to Cross Site Scripting

• Cross-site scripting (XSS)

<=2.4.0 · no fixed version yet

xxl-job-admin vulnerable to Insecure Permissions

• Broken access control

<=2.4.0 · no fixed version yet

In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack

• Path traversal

>=1.1.0, <1.1.13 || >=1.0.0, <1.0.39 · fixed in 1.1.13, 1.0.39

Java: DoS Vulnerability in JSON-JAVA

• Denial of service
• CWE-358

<20231013 · fixed in 20231013

Signing DynamoDB Sets when using the AWS Database Encryption SDK.

>=3.0.0, <3.1.1 · fixed in 3.1.1

Duplicate Advisory: Eclipse IDE XXE in eclipse.platform

• XML external entities (XXE)

<4.29 · fixed in 4.29

XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu

• Cross-site scripting (XSS)

>=9.7-rc-1, <14.10.14 || >=15.0-rc-1, <15.5.1 · fixed in 14.10.14, 15.5.1

XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest

• Code injection

<14.10.14 · fixed in 14.10.14

Apache UIMA Java SDK Deserialization of Untrusted Data, Improper Input Validation vulnerability

• Insecure deserialization
• CWE-20

<3.5.0 · fixed in 3.5.0

wildfly-core Exposure of Sensitive Information to an Unauthorized Actor vulnerability

• Information disclosure

<22.0.0.Final · fixed in 22.0.0.Final

XWiki Platform privilege escalation from script right to programming right through title displayer

• Broken access control

>=3.2-milestone-3, <14.10.7 || >=15.0, <15.2-rc-1 · fixed in 14.10.7, 15.2-rc-1

XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action

• Code injection

>=15.0, <15.2-rc-1 || >=1.0, <14.10.6 · fixed in 15.2-rc-1, 14.10.6

XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token

• Code injection
• Cross-site request forgery (CSRF)

>=1.0, <14.10.7 || >=15.0, <15.2-rc-1 · fixed in 14.10.7, 15.2-rc-1

Eclipse Parsson Denial of Service vulnerability

• Denial of service
• CWE-20

>=1.1.0, <1.1.4 || <1.0.5 · fixed in 1.1.4, 1.0.5

Eclipse Glassfish remote code execution issue

• CWE-20
• CWE-913

>=5.0.0, <7.0.0 · fixed in 7.0.0

Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key

• Hard-coded credentials

<3.8.1 · fixed in 3.8.1

OpenCRX allows a remote attacker to execute arbitrary code via a crafted request

• XML external entities (XXE)
• Server-side request forgery (SSRF)

<5.3.0 · fixed in 5.3.0

DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998

<2.5.2.0 · fixed in 2.5.2.0

Apache ActiveMQ is vulnerable to Remote Code Execution

• Insecure deserialization

<5.15.16 || >=5.16.0, <5.16.7 || >=5.17.0, <5.17.6 || >=5.18.0, <5.18.3 · fixed in 5.15.16, 5.16.7, 5.17.6, 5.18.3

Elasticsearch vulnerable to stack overflow in the search API

• Memory corruption

>=7.0.0, <7.17.13 || >=8.0.0, <8.9.1 · fixed in 7.17.13, 8.9.1

Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs

• Information disclosure

>=7.0.0, <7.17.13 || >=8.0.0, <8.9.2 · fixed in 7.17.13, 8.9.2

Elasticsearch vulnerable to Uncontrolled Resource Consumption

• Denial of service

<7.17.13 || >=8.0.0, <8.9.0 · fixed in 7.17.13, 8.9.0

XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages

• Cross-site scripting (XSS)

>=3.1-milestone-2, <13.4-rc-1 · fixed in 13.4-rc-1

XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

• Cross-site scripting (XSS)

>=12.0-rc-1, <14.10.12 || >=15.0-rc-1, <15.5-rc-1 · fixed in 14.10.12, 15.5-rc-1

XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

• CWE-116

>=7.2-milestone-2, <14.10.12 · fixed in 14.10.12

XWiki Platform XSS vulnerability from account in the create page form via template provider

• Cross-site scripting (XSS)

>=3.1-milestone-1, <13.4-rc-1 · fixed in 13.4-rc-1

org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter

• Path traversal

>=3.5-milestone-1, <14.10.8 || >=15.0-rc-1, <15.3-rc-1 · fixed in 14.10.8, 15.3-rc-1

XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro

• Privilege escalation

<14.10.6 · fixed in 14.10.6

org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents

• Information disclosure

>=9.4-rc-1, <14.10.8 || >=15.0-rc-1, <15.3-rc-1 · fixed in 14.10.8, 15.3-rc-1

org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move

• Broken access control

>=14.0-rc-1, <14.4.8 || >=14.5, <14.10.4 · fixed in 14.4.8, 14.10.4

Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet

• Code injection

>=5.1-rc-1, <14.10.8 · fixed in 14.10.8

org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability

• Cross-site scripting (XSS)
• CWE-86

>=14.6-rc-1, <14.10.4 · fixed in 14.10.4

Jenkins lambdatest-automation Plugin missing permission check

• Broken access control

<1.20.10 · fixed in 1.20.10

Stored XSS vulnerability in Jenkins GitHub Plugin

• Cross-site scripting (XSS)

<1.37.3.1 · fixed in 1.37.3.1

Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion

• Path traversal

<1.1.33 · fixed in 1.1.33

Jenkins Edgewall Trac Plugin vulnerable to Stored XSS

• Cross-site scripting (XSS)

<=1.13 · no fixed version yet

Jenkins lambdatest-automation Plugin may expose Credentials access token

• Information disclosure

<1.21.0 · fixed in 1.21.0

Jenkins CloudBees CD Plugin vulnerable to arbitrary file read

• Path traversal

<1.1.33 · fixed in 1.1.33