Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 7.1 High
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
- Open redirect
- CWE-20
<23.0.3 · fixed in 23.0.3
GHSA-mpwq-j3xf-7m5w · CVE-2023-6291 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache IoTDB: Unsafe deserialize map in Sync Tool
- Insecure deserialization
>=0.13.0, <1.2.2 · fixed in 1.2.2
GHSA-f23h-52hj-99p6 · CVE-2023-51656 - CVSS 6.5 Medium
Grails data binding causes JVM crash and/or other denial of service
- Denial of service
>=6.0.0, <6.1.0 || >=5.0.0, <5.3.4 || >=4.0.0, <4.1.3 || >=2.0.0, <3.3.17 · fixed in 6.1.0, 5.3.4, 4.1.3, 3.3.17
GHSA-3pjv-r7w4-2cf5 · CVE-2023-46131 - CVSS 7.5 High
Apache Pulsar WebSocket Proxy contains an Improper Authentication vulnerability
- Authentication bypass
<2.10.5 || >=2.11.0, <2.11.2 || >=3.0.0, <3.0.1 · fixed in 2.10.5, 2.11.2, 3.0.1
GHSA-83q5-whqp-r8jr · CVE-2023-37544 - CVSS 8.3 High
Velocity execution without script right through tree macro
- Broken access control
>=8.3-rc-1, <14.10.7 || >=15.0-rc-1, <15.2-rc-1 · fixed in 14.10.7, 15.2-rc-1
GHSA-p5f8-qf24-24cj · CVE-2023-50732 - CVSS 4.6 Medium
Duplicate Advisory: Keycloak Open Redirect vulnerability
- Open redirect
<=23.0.3 · no fixed version yet
GHSA-3p75-q5cc-qmj7 - CVSS 7.5 High
Grackle has StackOverflowError in GraphQL query processing
- Denial of service
<=0.14.0 · no fixed version yet
GHSA-g56x-7j6w-g8r8 · CVE-2023-50730 - CVSS 4.6 Medium
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
- Cross-site scripting (XSS)
- CWE-75
<23.0.3 · fixed in 23.0.3
GHSA-cvg2-7c3j-g36j · CVE-2023-6134 - CVSS 4.7 Medium
Xnx3 Wangmarket Cross-Site Scripting vulnerability
- Cross-site scripting (XSS)
- Code injection
<=6.1.0 · no fixed version yet
GHSA-3x3w-849q-423v · CVE-2023-6886 - CVSS 10.0 CriticalCritical · CVSS 9+
Remote code execution/programming rights with configuration section from any user account
- Code injection
>=2.3, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1 · fixed in 14.10.15, 15.5.2, 15.7-rc-1
GHSA-qj86-p74r-7wp5 · CVE-2023-50723 - CVSS 9.7 CriticalCritical · CVSS 9+
XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
>=2.3, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1 · fixed in 14.10.15, 15.5.2, 15.7-rc-1
GHSA-cp3j-273x-3jxc · CVE-2023-50722 - CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Remote code execution from account through SearchAdmin
- Code injection
>=4.5-rc-1, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1 · fixed in 14.10.15, 15.5.2, 15.7-rc-1
GHSA-7654-vfh6-rw6x · CVE-2023-50721 - CVSS 5.3 Medium
Solr search discloses email addresses of users
- Information disclosure
<14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1 · fixed in 14.10.15, 15.5.2, 15.7-rc-1
GHSA-2grh-gr37-2283 · CVE-2023-50720 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Solr search discloses password hashes of all users
- Information disclosure
>=7.2-milestone-2, <14.10.15 || >=15.0-rc-1, <15.5.2 || >=15.6-rc-1, <15.7-rc-1 · fixed in 14.10.15, 15.5.2, 15.7-rc-1
GHSA-p6cp-6r35-32mh · CVE-2023-50719 - CVSS 4.9 Medium
Apache StreamPark: Authenticated system users could trigger SQL injection vulnerability
- SQL injection
>=2.0.0, <2.1.2 · fixed in 2.1.2
GHSA-rrcg-jwr5-32g7 · CVE-2023-30867 -
Apache StreamPark: Authenticated system users could trigger remote command execution
- Command injection
>=2.0.0, <2.1.2 · fixed in 2.1.2
GHSA-qg44-xqwj-wc28 · CVE-2023-49898 - CVSS 4.3 Medium
WSO2 API Manager allows attackers to change the API rating
- CWE-20
<=9.0.78 · no fixed version yet
GHSA-w7rx-824v-rgx5 · CVE-2023-6835 - CVSS 8.5 High
Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning
- Broken access control
<5.20.254 · fixed in 5.20.254
GHSA-f6jm-9pr8-9c3w · CVE-2023-6837 - CVSS 4.6 Medium
WSO2 products vulnerable to XML External Entity attack
- XML external entities (XXE)
<4.0.0-beta · fixed in 4.0.0-beta
GHSA-cr8h-fr86-8vfv · CVE-2023-6836 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
- Insecure deserialization
>=3.1.5, <3.1.6 · fixed in 3.1.6
GHSA-97rv-88gf-phvr · CVE-2023-46279 - CVSS 9.8 CriticalCritical · CVSS 9+
Bypass serialize checks in Apache Dubbo
- Insecure deserialization
>=3.1.0, <3.1.11 || >=3.2.0, <3.2.5 · fixed in 3.1.11, 3.2.5
GHSA-6x49-w35h-wqrj · CVE-2023-29234 - CVSS 4.6 Medium
Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
- CWE-75
<23.0.3 · fixed in 23.0.3
GHSA-5968-qw33-h47j - CVSS 7.7 High
Allocation of Resources Without Limits in Keycloak
- Denial of service
<21.0.0 · fixed in 21.0.0
GHSA-54f3-c6hg-865h · CVE-2023-6563 - CVSS 5.4 Medium
Cross-site Scripting in JFinalcms
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-xv7p-jw46-8r85 · CVE-2023-50137 - CVSS 5.4 Medium
Cross-site Scripting in JFinalcms
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-p3ph-6245-4wfc · CVE-2023-50102 - CVSS 5.4 Medium
Cross-site Scripting in JFinalcms
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-m3p6-43xj-pf9v · CVE-2023-50101 - CVSS 5.4 Medium
Cross-site Scripting in JFinalcms
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-3hf6-f8ch-5869 · CVE-2023-50100 - CVSS 6.1 Medium
Open redirect in Apache Shiro
- Open redirect
<1.13.0 || >=2.0.0-alpha-1, <2.0.0-alpha-4 · fixed in 1.13.0, 2.0.0-alpha-4
GHSA-hhw5-c326-822h · CVE-2023-46750 - CVSS 8.1 High
Arbitrary file deletion vulnerability in Jenkins Scriptler Plugin
<=342.v6a · no fixed version yet
GHSA-xcrr-x93h-rv4v · CVE-2023-50764 - CVSS 4.3 Medium
Tokens stored in plain text by Dingding JSON Pusher Plugin
- Information disclosure
<=2.0 · no fixed version yet
GHSA-wjr6-v4c7-8cv6 · CVE-2023-50772 - CVSS 4.3 Medium
Tokens stored in plain text by PaaSLane Estimate Plugin
- Information disclosure
- Broken access control
<=1.0.4 · no fixed version yet
GHSA-v9w3-34xq-hrjg · CVE-2023-50777 - CVSS 4.3 Medium
Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin
- Cross-site request forgery (CSRF)
<=1.0.10 · no fixed version yet
GHSA-v672-5x3h-57qp · CVE-2023-50775 - CVSS 4.3 Medium
Displayed in plain text by Dingding JSON Pusher Plugin
- Information disclosure
<=2.0 · no fixed version yet
GHSA-q5cj-xf99-79m8 · CVE-2023-50773 - CVSS 4.2 Medium
Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability
- Cross-site request forgery (CSRF)
<3.18.1-01 · fixed in 3.18.1-01
GHSA-phjq-7xqp-2526 · CVE-2023-50768 - CVSS 4.3 Medium
Missing permission check in Jenkins PaaSLane Estimate Plugin
- Broken access control
<=1.0.4 · no fixed version yet
GHSA-jqr2-7f24-xrgc · CVE-2023-50779 - CVSS 4.3 Medium
Cross-Site Request Forgery in Jenkins PaaSLane Estimate Plugin
- Cross-site request forgery (CSRF)
<=1.0.4 · no fixed version yet
GHSA-g4xm-5mqm-8m32 · CVE-2023-50778 - CVSS 4.3 Medium
Tokens stored in plain text by PaaSLane Estimate Plugin
- Information disclosure
<=1.0.4 · no fixed version yet
GHSA-c2f6-rf2r-6j6f · CVE-2023-50776 - CVSS 7.1 High
Jenkins Nexus Platform Plugin missing permission check
- Broken access control
<3.18.1-01 · fixed in 3.18.1-01
GHSA-9vrm-747r-668v · CVE-2023-50767 - CVSS 6.1 Medium
Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin
- Open redirect
<3.0 · fixed in 3.0
GHSA-9qv8-7jfq-73j2 · CVE-2023-50771 - CVSS 8.1 High
Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin
- Cross-site request forgery (CSRF)
<=1.02 · no fixed version yet
GHSA-7ccg-jm7j-4f8v · CVE-2023-50774 - CVSS 6.7 Medium
Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin
- Information disclosure
- Hard-coded credentials
<4.229.vf736b · fixed in 4.229.vf736b
GHSA-6r5w-jjr5-qvgr · CVE-2023-50770 - CVSS 4.3 Medium
Missing permission check in Jenkins Scriptler Plugin
- Broken access control
<=342.v6a · no fixed version yet
GHSA-4j42-6xfx-h754 · CVE-2023-50765 - CVSS 7.1 High
Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability
- Cross-site request forgery (CSRF)
<3.18.1-01 · fixed in 3.18.1-01
GHSA-4gfc-72gw-v385 · CVE-2023-50766 - CVSS 4.2 Medium
Jenkins Nexus Platform Plugin missing permission check
- Broken access control
<3.18.1-01 · fixed in 3.18.1-01
GHSA-4g5f-w3mh-w99m · CVE-2023-50769 - CVSS 5.4 Medium
Cross-site Scripting in silverpeas
- Cross-site scripting (XSS)
<6.3.2 · fixed in 6.3.2
GHSA-wgrw-fj3v-fhc5 · CVE-2023-47324 - CVSS 4.3 Medium
Broken access control in Silverpeas
- Broken access control
<6.3.2 · fixed in 6.3.2
GHSA-vpp3-hpcm-v944 · CVE-2023-47327 - CVSS 8.8 High
Cross Site Request Forgery in Silverpeas
- Cross-site request forgery (CSRF)
<6.3.2 · fixed in 6.3.2
GHSA-gqgv-7wpj-vm6q · CVE-2023-47326 - CVSS 8.8 High
Cross Site Request Forgery in Silverpeas
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
<6.3.2 · fixed in 6.3.2
GHSA-g27c-w2v7-88xp · CVE-2023-47322 - CVSS 7.5 High
Missing access control in Silverpeas
<6.3.2 · fixed in 6.3.2
GHSA-cwh6-hm53-6w2m · CVE-2023-47323 - CVSS 5.4 Medium
Broken access control in Silverpeas
- Broken access control
<6.3.2 · fixed in 6.3.2
GHSA-42g3-3jwm-63rx · CVE-2023-47325 - CVSS 4.9 Medium
Broken access control in Silverpeas
- Broken access control
<6.3.2 · fixed in 6.3.2
GHSA-28wg-8gv4-mpjf · CVE-2023-47321 - CVSS 8.1 High
Broken access control in Silverpeas
- Broken access control
<6.3.2 · fixed in 6.3.2
GHSA-whgv-6j78-5rh2 · CVE-2023-47320 - CVSS 9.1 CriticalCritical · CVSS 9+
Improper JWT Signature Validation in SAP Security Services Library
- Privilege escalation
- CWE-749
<2.17.0 || >=3.0.0, <3.3.0 · fixed in 2.17.0, 3.3.0
GHSA-59c9-pxq8-9c73 · CVE-2023-50422 - CVSS 5.4 Medium
Alkacon OpenCMS XSS via Mercury template
- Cross-site scripting (XSS)
>=14.0.0, <16.0.0 · fixed in 16.0.0
GHSA-w62v-q77r-66cc · CVE-2023-6379 - CVSS 9.1 Critical
Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library
- Privilege escalation
- Broken access control
<2.17.0 || >=3.0.0, <3.3.0 · fixed in 2.17.0, 3.3.0
GHSA-gcgw-q47m-prvj - CVSS 7.5 High
Directory Traversal in JFinalCMS
- Path traversal
<=5.0.0 · no fixed version yet
GHSA-7x2g-4jvc-4x6p · CVE-2023-50449 - CVSS 7.4 High
Authorization bypass in Quarkus
- Broken access control
- CWE-551
>=2.14.0, <3.5.3 || <2.13.9.Final · fixed in 3.5.3, 2.13.9.Final
GHSA-mvc8-6ffp-jrx5 · CVE-2023-6394 - CVSS 5.4 Medium
Cross-site Scripting in JFinalCMS
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-m42v-qv3c-h6j7 · CVE-2023-49487 - CVSS 5.4 Medium
Cross-site Scripting in JFinalCMS
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-hjfp-2j7q-xmx4 · CVE-2023-49486 - CVSS 5.4 Medium
Cross-site Scripting in JFinalCMS
- Cross-site scripting (XSS)
<=5.0.0 · no fixed version yet
GHSA-f2w8-4m48-5qrq · CVE-2023-49485