Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Apache Struts vulnerable to path traversal
- Information disclosure
>=2.0.0, <2.5.33 || >=6.0.0, <6.3.0.2 · fixed in 2.5.33, 6.3.0.2
GHSA-2j39-qcjm-428w · CVE-2023-50164 - CVSS 5.3 Medium
Quarkus Cache Runtime exposes sensitive information to an unauthorized actor
- Information disclosure
>=3.3.0.CR1, <3.5.2 || >=3.2.0.CR1, <3.2.9.Final · fixed in 3.5.2, 3.2.9.Final
GHSA-xfv5-jqgp-vqhj · CVE-2023-6393 - CVSS 5.9 Medium
pubnub Insufficient Entropy vulnerability
- CWE-331
<0.4.0 · fixed in 0.4.0
GHSA-5844-q3fc-56rh · CVE-2023-26154 - CVSS 7.7 High
Data leak of password hash through change requests
- Hard-coded credentials
>=0.1, <1.10 · fixed in 1.10
GHSA-2fr7-cc7p-p45q · CVE-2023-49280 - CVSS 6.0 Medium
Elasticsearch-hadoop Unsafe Deserialization
- Insecure deserialization
<7.17.11 || >=8.0.0, <8.9.0 · fixed in 7.17.11, 8.9.0
GHSA-rv74-m283-5j95 · CVE-2023-46674 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/tag/save
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-rq2q-hc6h-2px2 · CVE-2023-49383 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/div/update
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-r222-mcff-27ff · CVE-2023-49381 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via admin/nav/delete
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-pv3g-vc3q-8c9g · CVE-2023-49448 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/category/delete
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-mwvq-gc5w-m78f · CVE-2023-49398 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/nav/save
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-hv4c-v8j8-54cw · CVE-2023-49446 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/category/update
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-8hch-q86g-j38w · CVE-2023-49395 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/category/save
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-882g-gjqp-9vjp · CVE-2023-49396 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/div/delete
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-6v55-h6m5-2352 · CVE-2023-49382 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-5f56-h6fg-rcrh · CVE-2023-49397 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/nav/update
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-32j2-c7mx-v4jj · CVE-2023-49447 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-w492-7g9m-j2ww · CVE-2023-49376 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/slide/update
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-r7w2-j96v-vw8m · CVE-2023-49374 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/tag/update
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-r6mg-fq87-gw34 · CVE-2023-49377 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-r2wj-mxvh-wqfh · CVE-2023-49379 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/form/save
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-gw26-cchc-8f2f · CVE-2023-49378 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-gfhv-xxqj-h323 · CVE-2023-49375 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-cj7j-23wf-mhrx · CVE-2023-49373 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-9wvj-wr2f-6mx6 · CVE-2023-49372 - CVSS 8.8 High
Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete
- Cross-site request forgery (CSRF)
<=5.0.0 · no fixed version yet
GHSA-765f-3mgx-24pw · CVE-2023-49380 - CVSS 7.5 High
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
- CWE-459
>=6.2.0, <6.3.0.1 || >=6.0.0, <6.1.2.2 || <2.5.32 · fixed in 6.3.0.1, 6.1.2.2, 2.5.32
GHSA-729q-fcgp-r5xh · CVE-2023-41835 - CVSS 9.8 CriticalCritical · CVSS 9+
HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
- Code injection
<3.9.0 · fixed in 3.9.0
GHSA-37vq-hr2f-g7h7 · CVE-2023-49093 - CVSS 9.8 CriticalCritical · CVSS 9+
Solon is vulnerable to Deserialization of Untrusted Data
- Insecure deserialization
<=2.6.0 · no fixed version yet
GHSA-vwgg-2q82-38c5 · CVE-2023-48967 - CVSS 9.8 CriticalCritical · CVSS 9+
Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download
- Server-side request forgery (SSRF)
<1.17.1 · fixed in 1.17.1
GHSA-gqj2-324p-vx73 · CVE-2023-48910 - CVSS 7.1 High
Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data
>=1.4.13, <1.4.14 || >=1.3.13, <1.3.14 || >=1.2.12, <1.2.13 · fixed in 1.4.14, 1.3.14, 1.2.13
GHSA-gm62-rw4g-vrc4 · CVE-2023-6481 - CVSS 9.8 CriticalCritical · CVSS 9+
Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request
- Code injection
- Insecure deserialization
<=1.3.1 · no fixed version yet
GHSA-6pqx-v9g4-5hc8 · CVE-2023-48887 - CVSS 6.5 Medium
OpenSearch StackOverflow vulnerability
<1.3.14 || >=2.0.0, <2.11.1 · fixed in 1.3.14, 2.11.1
GHSA-6g3j-p5g6-992f - CVSS 9.8 CriticalCritical · CVSS 9+
RuoYi vulnerable to SQL injection vulnerability
- SQL injection
<=4.6 · no fixed version yet
GHSA-fg29-37px-c7wm · CVE-2023-49371 - CVSS 7.5 High
Apache Tiles: Unvalidated input may lead to path traversal and XXE
- Path traversal
- Denial of service
>=1.3.0, <=1.3.10 · no fixed version yet
GHSA-qw4h-3xjj-84cc · CVE-2023-49735 - CVSS 5.0 Medium
Eclipse IDE XXE in eclipse.platform
- XML external entities (XXE)
<3.30.0 · fixed in 3.30.0
GHSA-j24h-xcpc-9jw8 · CVE-2023-4218 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability
- XML external entities (XXE)
>=2.2.0, <2.3.0 · fixed in 2.3.0
GHSA-77jg-cpw9-73vg · CVE-2023-49733 - CVSS 6.5 Medium
Apache DolphinScheduler Missing Authorization vulnerability
- Broken access control
<3.1.0 · fixed in 3.1.0
GHSA-r44q-98gx-pmh2 · CVE-2023-49620 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Cocoon SQL Injection vulnerability
- SQL injection
>=2.2.0, <2.3.0 · fixed in 2.3.0
GHSA-8v4w-jr33-4rh3 · CVE-2022-45135 - CVSS 7.5 High
Keycloak vulnerable to LDAP Injection on UsernameForm Login
- Other injection
- CWE-20
<23.0.1 · fixed in 23.0.1
GHSA-8hc5-rmgf-qx6p · CVE-2022-2232 - CVSS 4.3 Medium
Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability
- Cross-site request forgery (CSRF)
<2.2 · fixed in 2.2
GHSA-wpfc-r5qq-7r7p · CVE-2023-49673 - CVSS 4.3 Medium
Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials
- Hard-coded credentials
<3.12 · fixed in 3.12
GHSA-qmhq-876f-cr65 · CVE-2023-49653 - CVSS 4.3 Medium
Jenkins NeuVector Vulnerability Scanner Plugin missing permission check
- Broken access control
<2.2 · fixed in 2.2
GHSA-ph87-4x2g-6hp4 · CVE-2023-49674 - CVSS 4.3 Medium
Jenkins Google Compute Engine Plugin has incorrect permission checks
- Broken access control
<4.3.17.1 || >=4.5, <4.551.v5a · fixed in 4.3.17.1, 4.551.v5a
GHSA-pgpj-83g3-mfr2 · CVE-2023-49652 - CVSS 7.1 High
Jenkins MATLAB Plugin missing permission checks
- Broken access control
<2.11.1 · fixed in 2.11.1
GHSA-cv4x-9f34-8rp9 · CVE-2023-49654 - CVSS 7.1 High
Jenkins MATLAB Plugin cross-site request forgery vulnerability
- Cross-site request forgery (CSRF)
<2.11.1 · fixed in 2.11.1
GHSA-9f5g-rgcr-8grw · CVE-2023-49655 - CVSS 7.1 High
Jenkins MATLAB Plugin XML External Entity vulnerability
- XML external entities (XXE)
<2.11.1 · fixed in 2.11.1
GHSA-82q9-88m2-4v68 · CVE-2023-49656 - CVSS 7.1 High
logback serialization vulnerability
- Insecure deserialization
>=1.3.0, <1.3.12 || >=1.4.0, <1.4.12 || <1.2.13 · fixed in 1.3.12, 1.4.12, 1.2.13
GHSA-vmq6-5m68-f53m · CVE-2023-6378 - CVSS 7.5 High
Apache Tomcat Improper Input Validation vulnerability
- HTTP request smuggling
- CWE-20
>=11.0.0-M1, <11.0.0-M11 || >=10.1.0-M1, <10.1.16 || >=9.0.0-M1, <9.0.83 || >=8.5.0, <8.5.96 · fixed in 11.0.0-M11, 10.1.16, 9.0.83, 8.5.96
GHSA-fccv-jmmp-qg76 · CVE-2023-46589 - CVSS 7.5 High
ureport arbitrary file read vulnerability
- Path traversal
<=2.2.9 · no fixed version yet
GHSA-9vfc-qxc8-wrpq · CVE-2023-48848 - CVSS 8.8 HighCritical · CVSS 7+ and EPSS
Apache ActiveMQ Deserialization of Untrusted Data vulnerability
- Authentication bypass
- Insecure deserialization
<5.16.6 || >=5.17.0, <5.17.4 · fixed in 5.16.6, 5.17.4
GHSA-53v4-42fg-g287 · CVE-2022-41678 - CVSS 5.3 Medium
Spring Framework vulnerable to denial of service
>=6.0.0, <6.0.14 · fixed in 6.0.14
GHSA-v94h-hvhg-mf9h · CVE-2023-34053 - CVSS 5.3 Medium
Reactor Netty HTTP Server denial of service vulnerability
>=1.1.0, <1.1.13 || >=1.0.0, <1.0.39 · fixed in 1.1.13, 1.0.39
GHSA-q24v-hpg3-v3jp · CVE-2023-34054 - CVSS 5.3 Medium
Spring Boot Actuator denial of service vulnerability
<2.7.18 || >=3.0.0, <3.0.13 || >=3.1.0, <3.1.6 · fixed in 2.7.18, 3.0.13, 3.1.6
GHSA-jjfh-589g-3hjx · CVE-2023-34055 - CVSS 7.9 High
Improper Neutralization of Input in Advanced User Interface for Jolt
- Cross-site scripting (XSS)
<1.24.0 · fixed in 1.24.0
GHSA-68pr-6fjc-wmgm · CVE-2023-49145 -
Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year
<2.6.0.0 · fixed in 2.6.0.0
GHSA-r68h-jhhj-9jvm -
Apache DolphinScheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability
- Information disclosure
<3.2.1 · fixed in 3.2.1
GHSA-c6cg-73p3-973h · CVE-2023-49068 - CVSS 5.5 Medium
Bouncy Castle Denial of Service (DoS)
- Denial of service
<1.73 · fixed in 1.73
GHSA-wjxj-5m7g-mg7q · CVE-2023-33202 - CVSS 5.5 Medium
Apache Storm Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files
- Information disclosure
>=2.0.0, <2.6.0 · fixed in 2.6.0
GHSA-85p4-q357-72h9 · CVE-2023-43123 - CVSS 6.5 Medium
Directory Traversal in jeecg-boot
- Path traversal
<=3.6.0 · no fixed version yet
GHSA-rgg9-264h-3hfw · CVE-2023-47467 - CVSS 6.5 Medium
Elasticsearch Improper Handling of Exceptional Conditions
- CWE-755
>=7.0.0, <7.17.14 || >=8.0.0, <8.10.3 · fixed in 7.17.14, 8.10.3
GHSA-285m-vhfq-xx4h · CVE-2023-46673 - CVSS 7.0 High
APM Java Agent Local Privilege Escalation issue
- Privilege escalation
>=1.18.0, <1.27.1 · fixed in 1.27.1
GHSA-5xqm-hc45-f2g2 · CVE-2021-37942