Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

2,330 results · Clear filters · Feed

  • High 8.8
    CVE-2023-49397

    Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49372

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49396

    Cross-Site Request Forgery in JFinalCMS via /admin/category/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49447

    Cross-Site Request Forgery in JFinalCMS via /admin/nav/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49446

    Cross-Site Request Forgery in JFinalCMS via /admin/nav/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49380

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49398

    Cross-Site Request Forgery in JFinalCMS via /admin/category/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49448

    Cross-Site Request Forgery in JFinalCMS via admin/nav/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49383

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49379

    Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49375

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49395

    Cross-Site Request Forgery in JFinalCMS via /admin/category/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49381

    Cross-Site Request Forgery in JFinalCMS via /admin/div/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49376

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49377

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49373

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.

    com.jfinal:jfinal Maven
  • High 7.7
    CVE-2023-49280

    Data leak of password hash through xwiki change request

    XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes. Change request allows to edit any page by default, and the changes are then exported in an XML file that anyone can download. So it's p…

    xwiki-contrib application-changerequest org.xwiki.contrib.changerequest:application-changerequest-default Maven
  • High 7.1
    CVE-2023-6481

    Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

    A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback ch.qos.logback:logback-core Maven
  • High 7.5
    CVE-2023-49735

    Apache Tiles: Unvalidated input may lead to path traversal and XXE

    ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data…

    Apache Software Foundation Apache Tiles struts:struts org.apache.tiles:tiles-core Debian Ubuntu Maven
  • High 7.1
    CVE-2023-49656

    Jenkins MATLAB Plugin XML External Entity vulnerability

    Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins MATLAB Plugin org.jenkins-ci.plugins:matlab Web / CMS Maven
  • High 8.8
    CVE-2023-49673

    Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.

    Jenkins Project Jenkins NeuVector Vulnerability Scanner Plugin io.jenkins.plugins:neuvector-vulnerability-scanner Web / CMS Maven
  • High 7.1
    CVE-2023-49655

    Jenkins MATLAB Plugin cross-site request forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.

    Jenkins Project Jenkins MATLAB Plugin org.jenkins-ci.plugins:matlab Web / CMS Maven
  • High 7.1
    CVE-2023-49654

    Jenkins MATLAB Plugin missing permission checks

    Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.

    Jenkins Project Jenkins MATLAB Plugin org.jenkins-ci.plugins:matlab Web / CMS Maven
  • High 7.1
    CVE-2023-6378

    Logback "receiver" DOS vulnerability

    A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback trino tez Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2023-46589

    Apache Tomcat: HTTP request smuggling via malformed trailer headers

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • High 8.8
    CVE-2022-41678 Public exploit Scanner template EPSS 86%

    Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePos…

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • High 7.5
    CVE-2023-48848

    ureport arbitrary file read vulnerability

    An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.

    com.bstek.ureport:ureport2-core Maven
  • High 7.9
    CVE-2023-49145

    Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt

    Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSO…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jolt-transform-json-ui Maven
  • High 7.5
    CVE-2023-48796

    Apache dolphinscheduler sensitive information disclosure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also …

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler apache-dolphinscheduler Maven PyPI
  • High 7.0
    CVE-2021-37942

    APM Java Agent Local Privilege Escalation

    A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher …

    Elastic Elastic APM Java Agent co.elastic.apm:elastic-apm-agent co.elastic.apm:apm-agent-parent Maven
  • High 8.8
    CVE-2023-48293

    XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries

    The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki instal…

    xwiki-contrib application-admintools org.xwiki.contrib:xwiki-application-admintools Maven
  • High 7.5
    CVE-2023-48241 Scanner template EPSS 73%

    XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service

    XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes th…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-search-solr-query Maven
  • High 8.1
    CVE-2023-48222

    Authenticated users can view or delete jobs they do not have authorization for in Rundeck

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, …

    rundeck rundeck org.rundeck:rundeck Maven
  • High 7.5
    CVE-2023-26031

    Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems

    Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root …

    Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-yarn-project Maven
  • High 7.7
    CVE-2023-5720

    Quarkus: build env information disclosure via gradle plugin

    A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system wit…

    io.quarkus:quarkus-project Maven
  • High 7.5
    CVE-2023-5245

    Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.

    FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensor…

    ml.combust.mleap:mleap-runtime_2.12 Maven
  • High 7.5
    CVE-2023-34062

    In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack

    In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Rea…

    trino io.projectreactor.netty:reactor-netty-http Wolfi Maven
  • High 8.8
    CVE-2023-48089

    xxl-job-admin vulnerable to Remote Code Execution

    xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.

    com.xuxueli:xxl-job-admin Maven
  • High 8.8
    CVE-2023-39913

    Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formats

    Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK.This issue affects Apache UIMA Java SDK: before 3.5.0. Users are recommended to upgrade to ver…

    Apache Software Foundation Apache UIMA Java SDK Vinci adapter Apache UIMA Java SDK CPE Apache UIMA Java SDK tools Maven
  • High 7.5
    CVE-2023-31579

    Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key

    Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.

    top.tangyh.basic:lamp-core top.tangyh.basic:lamp-util Maven