Maven

7,117 results · Feed

• Low —
  GHSA-mwm4-5qwr-g9pf

  Keycloak is vulnerable to IDN homograph attack

  A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.

  org.keycloak:keycloak-services Maven
  Apr 28, 2022
• Medium 4.9
  CVE-2022-24898

  Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

  org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki ap…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  Apr 28, 2022
• Medium 5.4
  CVE-2022-24891 Public exploit

  Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

  ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteUR…

  ESAPI esapi-java-legacy org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  Apr 27, 2022
• Medium 6.5
  CVE-2022-1466

  Improper authorization in Keycloak

  Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.

  org.keycloak:keycloak-core Maven
  Apr 26, 2022
• High 8.8
  CVE-2022-24881

  Command Injection in Ballcat Codegen

  Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and fre…

  ballcat-projects ballcat-codegen com.hccake:ballcat-codegen Maven
  Apr 26, 2022
• Medium 6.1
  CVE-2022-26596

  Liferay Portal and Liferay DXP allows arbitrary injection via web content template names

  Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to in…

  com.liferay.portal:release.dxp.bom com.liferay:com.liferay.journal.content.web Maven
  Apr 25, 2022
• Medium 6.1
  CVE-2022-26597

  Liferay Portal and Liferay DXP allows arbitrary injection via the site name

  Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.

  com.liferay.portal:release.dxp.bom com.liferay:com.liferay.layout.seo.web Maven
  Apr 25, 2022
• High 7.5
  CVE-2022-29546

  OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser

  HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later v…

  net.sourceforge.htmlunit:neko-htmlunit Maven
  Apr 25, 2022
• High 7.5
  CVE-2022-23457 Public exploit

  Path Traversal in ESAPI

  ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the test…

  OWASP ESAPI org.owasp.esapi:esapi org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  Apr 25, 2022
• High 8.8
  CVE-2022-27340

  Cross Site Request Forgery in Mingsoft MCMS

  MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.

  net.mingsoft:ms-mcms Maven
  Apr 22, 2022
• Medium 6.1
  CVE-2022-29577 Public exploit

  Cross-site Scripting in OWASP AntiSamy

  OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2…

  libowasp-antisamy-java org.owasp.antisamy:antisamy Ubuntu Maven
  Apr 21, 2022
• Medium 6.1
  CVE-2022-28367

  Cross-site Scripting in OWASP AntiSamy

  OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

  libowasp-antisamy-java org.owasp.antisamy:antisamy libowasp-antisamy-java Debian Ubuntu Maven
  Apr 21, 2022
• High 7.5
  CVE-2022-28366

  Denial of service in HtmlUnit-Neko

  Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exis…

  libowasp-antisamy-java libowasp-antisamy-java net.sourceforge.htmlunit:neko-htmlunit Debian Ubuntu Maven
  Apr 21, 2022
• Medium 6.5
  CVE-2022-22969

  Denial of service in Spring Security OAuth2

  <Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or …

  org.springframework.security.oauth:spring-security-oauth2 Maven
  Apr 21, 2022
• Medium 6.1
  CVE-2022-28820

  Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution

  ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or san…

  Adobe Experience Manager com.adobe.acs:acs-aem-commons Maven
  Apr 21, 2022
• High 7.3
  CVE-2022-0272

  Improper Restriction of XML External Entity Reference in detekt/detekt

  Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.

  detekt detekt/detekt io.gitlab.arturbosch.detekt:detekt-core Maven
  Apr 21, 2022
• Medium 4.3
  CVE-2022-26595

  Liferay Portal and Liferay DXP fails to check permissions to view sites/groups

  Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site members…

  com.liferay.portal:release.portal.bom com.liferay.portal:release.dxp.bom com.liferay.portal:com.liferay.portal.impl com.liferay:com.liferay.site.browser.web Maven
  Apr 19, 2022
• Medium 5.4
  CVE-2022-26593

  Liferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category

  Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset ca…

  com.liferay.portal:release.dxp.bom com.liferay:com.liferay.asset.taglib Maven
  Apr 19, 2022
• High 8.8
  CVE-2022-28108 Scanner template EPSS 23%

  Selenium Server (Grid) CSRF

  Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

  selenium org.seleniumhq.selenium:selenium-server org.seleniumhq.selenium:selenium-grid Maven PyPI
  Apr 19, 2022
• Medium 4.3
  CVE-2021-3503

  Metrics exposure in Wildfly

  A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.

  org.wildfly:wildfly-metrics Maven
  Apr 18, 2022
• Medium 6.1
  CVE-2022-26594

  Liferay Portal and Liferay DXP allows arbitrary injection via form field

  Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder,…

  com.liferay.portal:release.dxp.bom com.liferay:com.liferay.dynamic.data.mapping.form.field.type Maven
  Apr 15, 2022
• High 7.5
  CVE-2022-22968 Public exploit

  Improper handling of case sensitivity in Spring Framework

  In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower ca…

  libspring-java libspring-java org.springframework:spring-context Debian Ubuntu Maven
  Apr 14, 2022
• High 7.2
  CVE-2022-24847

  Improper Input Validation in GeoServer

  GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in ar…

  geoserver geoserver org.geoserver:gs-main Maven
  Apr 13, 2022
• Critical 10.0
  CVE-2022-24816 Exploited Public exploit Scanner template EPSS 100%

  Improper Control of Generation of Code in jai-ext

  JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and …

  geosolutions-it jai-ext it.geosolutions.jaiext.jiffle:jt-jiffle it.geosolutions.jaiext.jiffle:jt-jiffle-language Maven
  Apr 13, 2022

  KEV Jun 26, 2024
• Medium 4.3
  CVE-2022-29052

  Private key stored in plain text by Jenkins Google Compute Engine Plugin

  Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

  Jenkins Project Jenkins Google Compute Engine Plugin org.jenkins-ci.plugins:google-compute-engine Web / CMS Maven
  Apr 12, 2022
• Medium 4.3
  CVE-2022-29051

  Missing permission checks in Jenkins Publish Over FTP Plugin

  Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials.

  Jenkins Project Jenkins Publish Over FTP Plugin org.jenkins-ci.plugins:publish-over-ftp Web / CMS Maven
  Apr 12, 2022
• High 8.8
  CVE-2022-29050

  CSRF vulnerability in Jenkins Publish Over FTP Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials.

  Jenkins Project Jenkins Publish Over FTP Plugin org.jenkins-ci.plugins:publish-over-ftp Web / CMS Maven
  Apr 12, 2022
• Medium 4.3
  CVE-2022-29048

  CSRF vulnerability in Jenkins Subversion Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Apr 12, 2022
• High 7.3
  CVE-2022-29047

  Untrusted users can modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries Plugin

  Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior…

  Jenkins Project Jenkins Pipeline: Shared Groovy Libraries Plugin org.jenkins-ci.plugins.workflow:workflow-cps-global-lib Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29046

  Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with It…

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29044

  Stored Cross-site Scripting in Jenkins Node and Label parameter Plugin

  Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/…

  Jenkins Project Jenkins Node and Label parameter Plugin org.jenkins-ci.plugins:nodelabelparameter Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29043

  Stored Cross-site Scripting in Jenkins Mask Passwords Plugin

  Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configur…

  Jenkins Project Jenkins Mask Passwords Plugin org.jenkins-ci.plugins:mask-passwords Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29042

  Stored Cross-site Scripting vulnerability in Jenkins Job Generator Plugin

  Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Parameters views, resulting in a stored cross-site scripting (XSS) vulnerability ex…

  Jenkins Project Jenkins Job Generator Plugin org.jenkins-ci.plugins:jobgenerator Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29041

  Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin

  Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke…

  Jenkins Project Jenkins JIRA Plugin org.jenkins-ci.plugins:jira Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29040

  Stored XSS vulnerability in Jenkins Git Parameter Plugin

  Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins Git Parameter Plugin org.jenkins-ci.tools:git-parameter Web / CMS Maven
  Apr 12, 2022
• High 8.0
  CVE-2022-29039

  Stored Cross-site Scripting vulnerability in Jenkins Gerrit Trigger Plugin

  Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Con…

  Jenkins Project Jenkins Gerrit Trigger Plugin com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29038

  Stored Cross-site Scripting vulnerabilities in Jenkins Extended Choice Parameter Plugin

  Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attack…

  Jenkins Project Jenkins Extended Choice Parameter Plugin org.jenkins-ci.plugins:extended-choice-parameter Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29037

  Stored XSS in Jenkins CVS Plugin

  Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins CVS Plugin org.jenkins-ci.plugins:cvs Web / CMS Maven
  Apr 12, 2022
• Critical 9.8
  CVE-2021-31805 Public exploit Scanner template EPSS 85%

  Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

  The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluatio…

  Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  Apr 12, 2022
• High 8.0
  CVE-2022-29049

  Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL

  Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.

  Jenkins Project Jenkins promoted builds Plugin org.jenkins-ci.plugins:promoted-builds Web / CMS Maven
  Apr 12, 2022