Maven

7,117 results · Feed

• Medium 4.3
  CVE-2023-32979

  Jenkins Email Extension Plugin missing permission check

  Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on…

  Jenkins Project Jenkins Email Extension Plugin org.jenkins-ci.plugins:email-ext Web / CMS Maven
  May 16, 2023
• Medium 4.3
  CVE-2023-32978

  Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery

  A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.

  Jenkins Project Jenkins LDAP Plugin org.jenkins-ci.plugins:ldap Web / CMS Maven
  May 16, 2023
• Medium 5.4
  CVE-2023-32977

  Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

  Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

  Jenkins Project Jenkins Pipeline: Job Plugin org.jenkins-ci.plugins.workflow:workflow-job Web / CMS Maven
  May 16, 2023
• Medium 5.4
  CVE-2023-31544

  alkacon-OpenCMS vulnerable to stored Cross-site Scripting

  A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.

  org.opencms:opencms-core Maven
  May 16, 2023
• Critical 9.8
  CVE-2023-31890

  glazedlists XML Deserialization vulnerability

  An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.

  com.glazedlists:glazedlists Maven
  May 16, 2023
• Medium 4.7
  CVE-2023-32068 Scanner template EPSS 54%

  URL Redirection to Untrusted Site in XWiki

  XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven
  May 15, 2023
• Critical 9.8
  CVE-2022-47937

  Multiple parsing problems in the Apache Sling Commons JSON module

  Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymor…

  Apache Software Foundation org.apache.sling.commons.json org.apache.sling:org.apache.sling.commons.json Maven
  May 15, 2023
• Medium 6.5
  CVE-2023-32081

  Vert.x STOMP server process client frames that would not send initially a connect frame

  Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an in…

  vert-x3 vertx-stomp io.vertx:vertx-stomp Maven
  May 12, 2023
• Medium 5.3
  CVE-2023-28936

  Apache OpenMeetings: insufficient check of invitation hash

  Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

  Apache Software Foundation Apache OpenMeetings org.apache.openmeetings:openmeetings-db Maven
  May 12, 2023
• High 8.1
  CVE-2023-29032

  Apache OpenMeetings: allows bypass authentication

  An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0

  Apache Software Foundation Apache OpenMeetings org.apache.openmeetings:openmeetings-parent Maven
  May 12, 2023
• High 7.2
  CVE-2023-29246

  Apache OpenMeetings: allows null-byte Injection

  An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

  Apache Software Foundation Apache OpenMeetings org.apache.openmeetings:openmeetings-parent Maven
  May 12, 2023
• Critical 9.1
  CVE-2023-32070 Public exploit

  Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

  XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This h…

  xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-syntax-xhtml org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml Maven
  May 10, 2023
• Critical 9.1
  CVE-2023-32071 EPSS 70%

  XWiki Platform vulnerable to RXSS via editor parameter - importinline template

  XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page w…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-distribution-war Maven
  May 9, 2023
• Critical 10.0
  CVE-2023-32069

  XWiki Platform privilege escalation (PR)/RCE from account through class sheet

  XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XW…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-test-ui Maven
  May 9, 2023
• Critical 9.1
  CVE-2023-31126 Public exploit

  Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml

  `org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. Th…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  May 9, 2023
• Medium 4.8
  CVE-2023-31141

  OpenSearch issue with fine-grained access control during extremely rare race conditions

  OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security a…

  OpenSearch security org.opensearch.plugin:opensearch-security opensearch Ubuntu Maven
  May 8, 2023
• High 8.8
  CVE-2020-22755

  MCMS vulnerable to arbitrary code execution via crafted thumbnail

  File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.

  net.mingsoft:ms-mcms Maven
  May 8, 2023
• High 8.1
  CVE-2021-40331

  Permissions problem in the Apache Ranger Hive Plugin

  An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue a…

  Apache Software Foundation Apache Ranger Hive Plugin org.apache.ranger:ranger-hive-plugin Maven
  May 5, 2023
• High 8.4
  CVE-2022-45048

  Apache Ranger: code execution vulnerability in policy expressions

  Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

  Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  May 5, 2023
• Critical 9.8
  CVE-2023-30331

  Server-side template injection in beetl

  An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.

  com.ibeetl:beetl Maven
  May 4, 2023
• Medium 6.1
  CVE-2023-30093

  ONOS vulnerable to Cross-site Scripting

  A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.

  org.onosproject:onos-archetypes Maven
  May 4, 2023
• High 8.2
  CVE-2023-25827

  Cross-site Scripting in OpenTSDB

  Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the sam…

  OpenTSDB OpenTSDB net.opentsdb:opentsdb Maven
  May 3, 2023
• Critical 9.8
  CVE-2023-25826 Public exploit Scanner template EPSS 43%

  Remote Code Execution in OpenTSDB

  Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that w…

  OpenTSDB OpenTSDB net.opentsdb:opentsdb Maven
  May 3, 2023
• High 8.8
  CVE-2023-32007 EPSS 76%

  Apache Spark: Shell command injection via Spark UI

  ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If AC…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.12 Maven PyPI
  May 2, 2023
• Critical 9.1
  CVE-2022-46365

  Apache StreamPark (incubating): Logic error causing any account reset

  Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, …

  Apache Software Foundation Apache StreamPark (incubating) org.apache.streampark:streampark Maven
  May 1, 2023
• Medium 5.4
  CVE-2022-45801

  Apache StreamPark (incubating): LDAP Injection Vulnerability

  Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possib…

  Apache Software Foundation Apache StreamPark (incubating) org.apache.streampark:streampark Maven
  May 1, 2023
• Critical 9.8
  CVE-2022-45802

  Apache StreamPark (incubating): Upload any file to any directory

  Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to …

  Apache Software Foundation Apache StreamPark (incubating) org.apache.streampark:streampark-common_2.11 org.apache.streampark:streampark-common_2.12 Maven
  May 1, 2023
• Medium —
  GHSA-jgvc-jfgh-rjvv

  Chosen Ciphertext Attack in Jose4j

  ### Summary RSA1_5 in jose4j is susceptible to chosen ciphertext attacks. The attack allows to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts. It may be feasible to sign with affected keys. ### Severity Moderate - exploiting this ciphertext attack could res…

  org.bitbucket.b_c:jose4j Maven
  Apr 27, 2023
• Medium 5.5
  CVE-2023-29471

  Lightbend Alpakka Kafka logs credentials on debug level

  Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

  com.typesafe.akka:akka-stream-kafka_2.13 com.typesafe.akka:akka-stream-kafka_2.11 com.typesafe.akka:akka-stream-kafka_3 com.typesafe.akka:akka-stream-kafka_2.12 Maven
  Apr 27, 2023
• Critical 9.8
  CVE-2023-30349

  Remote code execution in JFinal CMS

  JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.

  com.jflyfox:jflyfox_jfinal Maven
  Apr 27, 2023
• Medium 5.4
  CVE-2023-22665

  Apache Jena: Exposure of arbitrary execution in script engine expressions.

  There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

  Apache Software Foundation Apache Jena apache-jena apache-jena Debian Ubuntu Maven
  Apr 25, 2023
• Critical 9.8
  CVE-2023-29924

  PowerJob vulnerable to incorrect access control

  PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.

  tech.powerjob:powerjob Maven
  Apr 21, 2023
• Critical 9.1
  CVE-2023-29528 Public exploit

  Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

  XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary H…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  Apr 20, 2023
• Medium 4.3
  CVE-2023-25601

  Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication

  On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version…

  Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-api Maven
  Apr 20, 2023
• Critical 9.8
  CVE-2023-29926

  PowerJob vulnerable to remote code execution

  PowerJob V4.3.2 has unauthorized interface that causes remote code execution.

  tech.powerjob:powerjob Maven
  Apr 20, 2023
• Critical 9.8
  CVE-2023-20873

  Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry

  In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users sh…

  org.springframework.boot:spring-boot-actuator-autoconfigure Maven
  Apr 20, 2023
• Medium 5.3
  CVE-2023-29921

  PowerJob Incorrect Access Control vulnerability

  PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.

  tech.powerjob:powerjob Maven
  Apr 19, 2023
• Medium 5.3
  CVE-2023-29922 Public exploit Scanner template

  PowerJob vulnerable to Incorrect Access Control via the create user/save interface.

  PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.

  tech.powerjob:powerjob Maven
  Apr 19, 2023
• Medium 5.3
  CVE-2023-29923 Public exploit Scanner template

  PowerJob vulnerable to Insecure Permissions

  PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.

  tech.powerjob:powerjob Maven
  Apr 19, 2023
• Medium 6.3
  CVE-2023-20862

  Spring Security logout not clearing security context

  In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly s…

  org.springframework.security:spring-security-core Maven
  Apr 19, 2023