Maven

7,117 results · Feed

• Medium 5.9
  CVE-2022-31023

  Dev error stack trace leaking into prod in Play Framework

  Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exceptio…

  playframework playframework com.typesafe.play:play_2.12 com.typesafe.play:play_2.13 Maven
  Jun 2, 2022
• High 7.5
  CVE-2022-31018

  Denial of service binding form from JSON in Play Framework

  Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` m…

  playframework playframework com.typesafe.play:play_2.12 com.typesafe.play:play_2.13 Maven
  Jun 2, 2022
• Medium 5.4
  CVE-2022-29648

  Cross site scripting in Jfinal

  A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.

  com.jflyfox:jflyfox_jfinal Maven
  May 31, 2022
• High 8.8
  CVE-2022-29647

  Cross Site Request Forgery in Mingsoft MCMS

  An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.

  net.mingsoft:ms-mcms Maven
  May 31, 2022
• High 7.4
  CVE-2022-29258

  Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

  XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 1…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-filter-ui Maven
  May 31, 2022
• High 7.5
  CVE-2022-23082 Public exploit

  CureKit - Path Traversal in isFileOutsideDir

  In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

  WhiteSource CureKit io.whitesource:curekit Maven
  May 31, 2022
• Medium 5.5
  CVE-2022-30973

  Missing fix for CVE-2022-30126 in 1.28.2

  We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a…

  Apache Software Foundation Apache Tika tika org.apache.tika:tika-core Ubuntu Maven
  May 31, 2022
• Critical 9.8
  CVE-2022-30506

  Code injection in MCMS

  An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.

  net.mingsoft:ms-mcms Maven
  May 27, 2022
• High —
  CVE-2022-30500

  SQL injection in jflyfox jfinal

  Jfinal cms 5.1.0 is vulnerable to SQL Injection.

  com.jflyfox:jflyfox_jfinal Maven
  May 26, 2022
• High 7.4
  CVE-2022-29251

  Cross-site Scripting in the Flamingo theme manager

  XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page relate…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-flamingo-theme-ui Maven
  May 25, 2022
• High 7.4
  CVE-2022-29252

  Cross-site Scripting in XWiki Platform Wiki UI Main Wiki

  XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" …

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Maven
  May 25, 2022
• Low 2.7
  CVE-2022-29253

  Path Traversal in XWiki Platform

  XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a pa…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven
  May 25, 2022
• Medium 6.5
  CVE-2022-29405

  Apache Archiva Arbitrary user password reset vulnerability

  In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8

  Apache Software Foundation Apache Archiva org.apache.archiva:archiva Maven
  May 25, 2022
• Medium 5.9
  CVE-2021-3597

  undertow Race Condition vulnerability

  A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  May 24, 2022
• High 7.5
  CVE-2021-3629

  Undertow Uncontrolled Resource Consumption

  A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Und…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  May 24, 2022
• High 7.8
  CVE-2021-3717

  Wildfly-Core user account mismanagement

  A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, an…

  org.wildfly.core:wildfly-core-parent Maven
  May 24, 2022
• High 7.5
  CVE-2022-29249

  Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ

  JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the hi…

  JavaEZLib JavaEZ io.github.javaezlib:JavaEZ Maven
  May 24, 2022
• Medium 5.4
  CVE-2022-29237

  Limited Authentication Bypass for Media Files in Opencast

  Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import i…

  opencast opencast org.opencastproject:opencast-ingest-service-impl Maven
  May 24, 2022
• Medium 5.7
  CVE-2022-29567

  Possible information disclosure inside TreeGrid component with default data provider

  The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resultin…

  vaadin vaadin vaadin-grid-flow com.vaadin:vaadin Maven
  May 24, 2022
• Critical 9.0
  CVE-2022-1848

  Business Logic Errors in erudika/para

  Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.

  Erudika erudika/para com.erudika:para-core Maven
  May 24, 2022
• High 8.8
  CVE-2022-29002

  Cross-Site Request Forgery in XXL-Job

  A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.

  com.xuxueli:xxl-job Maven
  May 23, 2022
• Critical 9.8
  CVE-2022-29599

  Commandline class shell injection vulnerabilities

  In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

  Apache Software Foundation Apache Maven org.apache.maven.shared:maven-shared-utils maven-shared-utils Debian Ubuntu Maven
  May 23, 2022
• Critical 9.8
  CVE-2022-31267 EPSS 18%

  Unescaped control characters in Gitblit

  Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value.

  com.gitblit:gitblit Maven
  May 21, 2022
• High 7.5
  CVE-2022-31268 Scanner template EPSS 11%

  Path traversal in Gitblit

  A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).

  com.gitblit:gitblit Maven
  May 21, 2022
• High 7.5
  CVE-2022-24434 Public exploit

  Denial of Service (DoS)

  This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

  org.webjars.npm:dicer dicer npm Maven
  May 20, 2022
• Medium 5.3
  CVE-2022-22976 Public exploit

  Integer overflow in BCrypt class in Spring Security

  Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due t…

  libspring-java org.springframework.security:spring-security-core Ubuntu Maven
  May 19, 2022
• Critical 9.8
  CVE-2022-22978 Public exploit EPSS 12%

  Authorization bypass in Spring Security

  In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression …

  libspring-java org.springframework.security:spring-security-core org.springframework.security:spring-security-web Ubuntu Maven
  May 19, 2022
• Critical 9.4
  CVE-2022-1782

  Cross-site Scripting (XSS) - Generic in erudika/para

  Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.

  Erudika erudika/para com.erudika:para-core Maven
  May 18, 2022
• High 7.1
  CVE-2022-30972

  Cross Site Request Forgery in Jenkins Storable Configs Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins cont…

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  May 17, 2022
• High 7.1
  CVE-2022-30971

  XML External Entity Reference in Jenkins Storable Configs Plugin

  Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30970

  Cross-site Scripting in Jenkins Autocomplete Parameter Plugin

  Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulner…

  Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven
  May 17, 2022
• High 8.8
  CVE-2022-30969

  Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.

  Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30968

  Cross-site Scripting in Jenkins vboxwrapper Plugin

  Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins vboxwrapper Plugin org.jenkins-ci.plugins:vboxwrapper Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30967

  Cross site scripting in Jenkins Selection tasks Plugin

  Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with I…

  Jenkins Project Jenkins Selection tasks Plugin org.jvnet.hudson.plugins:selection-tasks-plugin Web / CMS Maven
  May 17, 2022
• Medium 5.4
  CVE-2022-30966

  Cross-site Scripting in Jenkins Random String Parameter Plugin

  Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Confi…

  Jenkins Project Jenkins Random String Parameter Plugin org.jenkins-ci.plugins:random-string-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30965

  Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types

  Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Co…

  Jenkins Project Jenkins Promoted Builds (Simple) Plugin org.jenkins-ci.plugins:promoted-builds-simple Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30964

  Cross-site Scripting in Jenkins Multiselect parameter Plugin

  Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure…

  Jenkins Project Jenkins Multiselect parameter Plugin io.jenkins.plugins:multiselect-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30963

  Cross-site Scripting in Jenkins JDK Parameter Plugin

  Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins JDK Parameter Plugin org.jenkins-ci.plugins:JDK_Parameter_Plugin Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30962

  Cross-site Scripting in Jenkins Global Variable String Parameter Plugin

  Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke…

  Jenkins Project Jenkins Global Variable String Parameter Plugin org.jenkins-ci.plugins:global-variable-string-parameter Web / CMS Maven
  May 17, 2022
• High 8.0
  CVE-2022-30961

  Cross-site Scripting in Jenkins Autocomplete Parameter Plugin

  Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers…

  Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven
  May 17, 2022