Maven

2,330 results · Clear filters · Feed

• High 8.0
  CVE-2022-34172

  Cross-site Scripting vulnerability in Jenkins

  In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jun 22, 2022
• High 8.0
  CVE-2022-34171

  Cross-site Scripting vulnerability in Jenkins

  In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jun 22, 2022
• High 8.0
  CVE-2022-34170

  Cross-site Scripting vulnerability in Jenkins

  In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jun 22, 2022
• High 8.0
  CVE-2022-34176 EPSS 78%

  Cross-site Scripting in Jenkins JUnit Plugin

  Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

  Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven
  Jun 22, 2022
• High 8.8
  CVE-2022-34177

  Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin

  Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside …

  Jenkins Project Jenkins Pipeline: Input Step Plugin org.jenkins-ci.plugins:pipeline-input-step Web / CMS Maven
  Jun 22, 2022
• High 7.5
  CVE-2022-22979

  Denial of Service in Spring Cloud Function

  In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.

  org.springframework.cloud:spring-cloud-function-parent Maven
  Jun 21, 2022
• High 7.5
  CVE-2020-28865

  Insufficiently Protected Credentials in PowerJob

  An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save.

  com.github.kfcfans:powerjob Maven
  Jun 16, 2022
• High 7.5
  CVE-2022-31044

  Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation

  Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibl…

  rundeck rundeck org.rundeck:rundeck Maven
  Jun 15, 2022
• High 8.8
  CVE-2022-33140 Public exploit

  Improper Neutralization of Command Elements in Shell User Group Provider

  The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUs…

  Apache Software Foundation Apache NiFi Apache NiFi Registry org.apache.nifi:nifi Maven
  Jun 15, 2022
• High 8.8
  CVE-2021-33036

  Apache Hadoop Privilege escalation vulnerability

  In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

  Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-yarn-server-common Maven
  Jun 15, 2022
• High 7.5
  CVE-2021-40660

  Regular expression denial of service in Delight Nashorn Sandbox

  An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.

  org.javadelight:delight-nashorn-sandbox Maven
  Jun 14, 2022
• High —
  CVE-2022-25167

  Apache Flume vulnerable to a JNDI RCE in JMSSource

  Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JN…

  Apache Software Foundation Apache Flume org.apache.flume.flume-ng-sources:flume-jms-source Maven
  Jun 14, 2022
• High 8.1
  CVE-2022-25845 Public exploit EPSS 19%

  Deserialization of Untrusted Data

  The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote serve…

  com.alibaba:fastjson Maven
  Jun 10, 2022
• High 7.5
  CVE-2022-29631

  Server-Side Request Forgery in Jodd HTTP

  Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted …

  org.jodd:jodd-http Maven
  Jun 6, 2022
• High 7.5
  CVE-2022-23712

  Improper Check for Unusual or Exceptional Conditions in Elasticsearch

  A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

  Elastic Elasticsearch org.elasticsearch:elasticsearch Maven
  Jun 6, 2022
• High 7.5
  CVE-2022-31018

  Denial of service binding form from JSON in Play Framework

  Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` m…

  playframework playframework com.typesafe.play:play_2.12 com.typesafe.play:play_2.13 Maven
  Jun 2, 2022
• High 8.8
  CVE-2022-29647

  Cross Site Request Forgery in Mingsoft MCMS

  An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.

  net.mingsoft:ms-mcms Maven
  May 31, 2022
• High 7.4
  CVE-2022-29258

  Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

  XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 1…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-filter-ui Maven
  May 31, 2022
• High 7.5
  CVE-2022-23082 Public exploit

  CureKit - Path Traversal in isFileOutsideDir

  In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

  WhiteSource CureKit io.whitesource:curekit Maven
  May 31, 2022
• High —
  CVE-2022-30500

  SQL injection in jflyfox jfinal

  Jfinal cms 5.1.0 is vulnerable to SQL Injection.

  com.jflyfox:jflyfox_jfinal Maven
  May 26, 2022
• High 7.4
  CVE-2022-29251

  Cross-site Scripting in the Flamingo theme manager

  XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page relate…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-flamingo-theme-ui Maven
  May 25, 2022
• High 7.4
  CVE-2022-29252

  Cross-site Scripting in XWiki Platform Wiki UI Main Wiki

  XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" …

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Maven
  May 25, 2022
• High 7.5
  CVE-2021-3629

  Undertow Uncontrolled Resource Consumption

  A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Und…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  May 24, 2022
• High 7.8
  CVE-2021-3717

  Wildfly-Core user account mismanagement

  A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, an…

  org.wildfly.core:wildfly-core-parent Maven
  May 24, 2022
• High 7.5
  CVE-2022-29249

  Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ

  JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the hi…

  JavaEZLib JavaEZ io.github.javaezlib:JavaEZ Maven
  May 24, 2022
• High 8.8
  CVE-2022-29002

  Cross-Site Request Forgery in XXL-Job

  A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.

  com.xuxueli:xxl-job Maven
  May 23, 2022
• High 7.5
  CVE-2022-31268 Scanner template EPSS 11%

  Path traversal in Gitblit

  A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).

  com.gitblit:gitblit Maven
  May 21, 2022
• High 7.5
  CVE-2022-24434 Public exploit

  Denial of Service (DoS)

  This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

  dicer org.webjars.npm:dicer npm Maven
  May 20, 2022
• High 7.1
  CVE-2022-30972

  Cross Site Request Forgery in Jenkins Storable Configs Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins cont…

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  May 17, 2022
• High 7.1
  CVE-2022-30971

  XML External Entity Reference in Jenkins Storable Configs Plugin

  Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30970

  Cross-site Scripting in Jenkins Autocomplete Parameter Plugin

  Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulner…

  Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven
  May 17, 2022
• High 8.8
  CVE-2022-30969

  Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.

  Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30968

  Cross-site Scripting in Jenkins vboxwrapper Plugin

  Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins vboxwrapper Plugin org.jenkins-ci.plugins:vboxwrapper Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30967

  Cross site scripting in Jenkins Selection tasks Plugin

  Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with I…

  Jenkins Project Jenkins Selection tasks Plugin org.jvnet.hudson.plugins:selection-tasks-plugin Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30965

  Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types

  Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Co…

  Jenkins Project Jenkins Promoted Builds (Simple) Plugin org.jenkins-ci.plugins:promoted-builds-simple Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30964

  Cross-site Scripting in Jenkins Multiselect parameter Plugin

  Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure…

  Jenkins Project Jenkins Multiselect parameter Plugin io.jenkins.plugins:multiselect-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30963

  Cross-site Scripting in Jenkins JDK Parameter Plugin

  Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins JDK Parameter Plugin org.jenkins-ci.plugins:JDK_Parameter_Plugin Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30962

  Cross-site Scripting in Jenkins Global Variable String Parameter Plugin

  Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke…

  Jenkins Project Jenkins Global Variable String Parameter Plugin org.jenkins-ci.plugins:global-variable-string-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30961

  Cross-site Scripting in Jenkins Autocomplete Parameter Plugin

  Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers…

  Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30960

  Cross-site Scripting in Jenkins Application Detector Plugin

  Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure …

  Jenkins Project Jenkins Application Detector Plugin org.jenkins-ci.plugins:app-detector Web / CMS Maven
  May 17, 2022