Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

7,117 results · Feed

  • High 8.8
    CVE-2023-49446

    Cross-Site Request Forgery in JFinalCMS via /admin/nav/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49380

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49398

    Cross-Site Request Forgery in JFinalCMS via /admin/category/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49448

    Cross-Site Request Forgery in JFinalCMS via admin/nav/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49383

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49379

    Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49375

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49395

    Cross-Site Request Forgery in JFinalCMS via /admin/category/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49381

    Cross-Site Request Forgery in JFinalCMS via /admin/div/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49376

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49377

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49373

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.

    com.jfinal:jfinal Maven
  • High 7.7
    CVE-2023-49280

    Data leak of password hash through xwiki change request

    XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes. Change request allows to edit any page by default, and the changes are then exported in an XML file that anyone can download. So it's p…

    xwiki-contrib application-changerequest org.xwiki.contrib.changerequest:application-changerequest-default Maven
  • High 7.1
    CVE-2023-6481

    Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

    A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback ch.qos.logback:logback-core Maven
  • Critical 9.8
    CVE-2023-49093

    HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL

    HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0

    HtmlUnit htmlunit htmlunit org.htmlunit:htmlunit Ubuntu Maven
  • Critical 9.8
    CVE-2023-48967

    Solon is vulnerable to Deserialization of Untrusted Data

    Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.

    org.noear:solon Maven
  • Critical 9.8
    CVE-2023-48910

    Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download

    Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

    io.github.microcks:microcks Maven
  • Medium 6.5
    GHSA-6g3j-p5g6-992f

    OpenSearch StackOverflow vulnerability

    ### Impact A flaw was discovered in OpenSearch, affecting the `_search` API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The issue was identified by Elastic Engineering and corresponds to security…

    org.opensearch:opensearch Maven
  • Critical 9.8
    CVE-2023-48887

    Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request

    A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.

    org.jupiter-rpc:jupiter-rpc Maven
  • Critical 9.8
    CVE-2023-49371

    RuoYi vulnerable to SQL injection vulnerability

    RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.

    com.ruoyi:ruoyi Maven
  • High 7.5
    CVE-2023-49735

    Apache Tiles: Unvalidated input may lead to path traversal and XXE

    ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data…

    Apache Software Foundation Apache Tiles struts:struts org.apache.tiles:tiles-core Debian Ubuntu Maven
  • Critical 9.8
    CVE-2023-49733

    Apache Cocoon's StreamGenerator is vulnerable to XXE injection

    Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.

    Apache Software Foundation Apache Cocoon org.apache.cocoon:cocoon Maven
  • Medium 6.5
    CVE-2023-49620

    Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

    Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve a…

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-api org.apache.dolphinscheduler:dolphinscheduler-common Maven
  • Critical 9.8
    CVE-2022-45135

    Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.

    Apache Software Foundation Apache Cocoon org.apache.cocoon:cocoon Maven
  • Medium 4.3
    CVE-2023-49674

    Jenkins NeuVector Vulnerability Scanner Plugin missing permission check

    A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.

    Jenkins Project Jenkins NeuVector Vulnerability Scanner Plugin io.jenkins.plugins:neuvector-vulnerability-scanner Web / CMS Maven
  • High 7.1
    CVE-2023-49656

    Jenkins MATLAB Plugin XML External Entity vulnerability

    Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins MATLAB Plugin org.jenkins-ci.plugins:matlab Web / CMS Maven
  • High 8.8
    CVE-2023-49673

    Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.

    Jenkins Project Jenkins NeuVector Vulnerability Scanner Plugin io.jenkins.plugins:neuvector-vulnerability-scanner Web / CMS Maven
  • High 7.1
    CVE-2023-49655

    Jenkins MATLAB Plugin cross-site request forgery vulnerability

    A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.

    Jenkins Project Jenkins MATLAB Plugin org.jenkins-ci.plugins:matlab Web / CMS Maven
  • High 7.1
    CVE-2023-49654

    Jenkins MATLAB Plugin missing permission checks

    Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.

    Jenkins Project Jenkins MATLAB Plugin org.jenkins-ci.plugins:matlab Web / CMS Maven
  • Medium 4.3
    CVE-2023-49653

    Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials

    Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.

    Jenkins Project Jenkins JIRA Plugin org.jenkins-ci.plugins:jira Web / CMS Maven
  • Medium 4.3
    CVE-2023-49652

    Jenkins Google Compute Engine Plugin has incorrect permission checks

    Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials…

    Jenkins Project Jenkins Google Compute Engine Plugin org.jenkins-ci.plugins:google-compute-engine Web / CMS Maven
  • High 7.1
    CVE-2023-6378

    Logback "receiver" DOS vulnerability

    A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback trino tez Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2023-46589

    Apache Tomcat: HTTP request smuggling via malformed trailer headers

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • High 8.8
    CVE-2022-41678 Public exploit Scanner template EPSS 86%

    Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePos…

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • Medium 5.3
    CVE-2023-34055

    Spring Boot server Web Observations DoS Vulnerability

    In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following…

    Spring Spring Boot org.springframework.boot:spring-boot-actuator Maven
  • Medium 5.3
    CVE-2023-34054

    Reactor Netty HTTP Server Metrics DoS Vulnerability

    In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerabl…

    Spring Reactor Netty io.projectreactor.netty:reactor-netty-core Maven
  • Medium 5.3
    CVE-2023-34053

    Spring Framework server Web Observations DoS Vulnerability

    In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the applicat…

    Spring Spring Framework libspring-java org.springframework:spring-webmvc Ubuntu Maven
  • High 7.5
    CVE-2023-48848

    ureport arbitrary file read vulnerability

    An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.

    com.bstek.ureport:ureport2-core Maven
  • High 7.9
    CVE-2023-49145

    Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt

    Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSO…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jolt-transform-json-ui Maven
  • Medium —
    GHSA-r68h-jhhj-9jvm

    Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year

    ### Impact The `Validator.isValidSafeHTML` method can result in false negatives where it reports some input as safe (i.e., returns true), but really isn't, and using that same input as-is can in certain circumstances result in XSS vulnerabilities. Because thi…

    org.owasp.esapi:esapi Maven