Security Digest · page 3 of 4
Critical Maven advisories (page 3)
334 critical advisories for Maven packages since October 2023, newest first. Check your project with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
- XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList CVE-2024-55877 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-help-ui>= 9.7-rc-1, < 15.10.11 → fixed in 15.10.11;org.xwiki.platform:xwiki-platform-help-ui>= 16.0.0-rc-1, < 16.4.1 → fixed in 16.4.1;org.xwiki.platform:xwiki-platform-help-ui>= 16.5.0-rc-1, < 16.5.0 → fixed in 16.5.0 - Apache Struts file upload logic is flawed CVE-2024-53677 CVSS 9.5 Critical
org.apache.struts:struts2-core< 6.4.0 → fixed in 6.4.0 - AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVE-2024-53990 CVSS 9.2 Critical
org.asynchttpclient:async-http-client>= 2.1.0, < 2.12.4 → fixed in 2.12.4;org.asynchttpclient:async-http-client>= 3.0.0.Beta1, < 3.0.1 → fixed in 3.0.1 - Apache Tomcat - Authentication Bypass CVE-2024-52316 CVSS 9.8 Critical
org.apache.tomcat:tomcat-catalina< 9.0.96 → fixed in 9.0.96;org.apache.tomcat:tomcat-catalina>= 10.1.0-M1, < 10.1.30 → fixed in 10.1.30;org.apache.tomcat:tomcat-catalina>= 11.0.0-M1, <= 11.0.0-M26 → fixed in 11.0.1 - Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications CVE-2024-38821 CVSS 9.3 Critical
org.springframework.security:spring-security-web>= 5.8.0, < 5.8.15 → fixed in 5.8.15;org.springframework.security:spring-security-web>= 6.2.0, < 6.2.7 → fixed in 6.2.7;org.springframework.security:spring-security-web>= 6.0.0, < 6.0.13 → fixed in 6.0.13; +3 more packages - Butterfly has path/URL confusion in resource handling leading to multiple weaknesses CVE-2024-47883 CVSS 9.1 Critical
org.openrefine.dependencies:butterfly< 1.2.6 → fixed in 1.2.6 - Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console CVE-2024-8980 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom>= 7.0.0-a1, < 7.4.3.102-GA102 → fixed in 7.4.3.102-GA102;com.liferay.portal:release.dxp.bom>= 2023.Q3.1, < 2023.Q3.5 → fixed in 2023.Q3.5;com.liferay.portal:release.dxp.bom>= 7.0.0-GA, <= 7.0.10.fp102 → no fix listed; +4 more packages - Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions CVE-2024-38002 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom>= 7.3.2-ga3, < 7.4.3.112-ga112 → fixed in 7.4.3.112-ga112;com.liferay.portal:release.dxp.bom>= 2023.Q4.0, < 2023.Q4.6 → fixed in 2023.Q4.6;com.liferay.portal:release.dxp.bom>= 2023.Q3.1, < 2023.Q3.9 → fixed in 2023.Q3.9; +2 more packages - Improper Authentication vulnerability in Apache Solr CVE-2024-45216 CVSS 9.3 Critical
org.apache.solr:solr>= 5.3.0, < 8.11.4 → fixed in 8.11.4;org.apache.solr:solr>= 9.0.0, < 9.7.0 → fixed in 9.7.0 - JSONPath Plus Remote Code Execution (RCE) Vulnerability CVE-2024-21534 CVSS 9.3 Critical
org.webjars.npm:jsonpath-plus<= 6.0.1 → no fix listed;jsonpath-plus< 10.2.0 → fixed in 10.2.0 - pac4j-core affected by a Java deserialization vulnerability CVE-2023-25581 CVSS 9.2 Critical
org.pac4j:pac4j-core< 4.0.0 → fixed in 4.0.0 - Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK) CVE-2024-47561 CVSS 9.3 Critical
org.apache.avro:avro< 1.11.4 → fixed in 1.11.4 - Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation CVE-2024-47807 CVSS 9.2 Critical
org.jenkins-ci.plugins:oic-auth< 4.355.v3a → fixed in 4.355.v3a - Jenkins OpenId Connect Authentication Plugin lacks audience claim validation CVE-2024-47806 CVSS 9.2 Critical
org.jenkins-ci.plugins:oic-auth< 4.355.v3a → fixed in 4.355.v3a - DataEase's H2 datasource has a remote command execution risk CVE-2024-46997 CVSS 9.3 Critical
io.dataease:common<= 2.10.0 → fixed in 2.10.1 - hermes-management is vulnerable to RCE due to Apache commons-jxpath GHSA-2gh6-wc3m-g37f CVSS 9.3 Critical
pl.allegro.tech.hermes:hermes-management>= 0.8.2, < 2.2.9 → fixed in 2.2.9 - Apache Seata Deserialization of Untrusted Data vulnerability CVE-2024-22399 CVSS 9.2 Critical
org.apache.seata:seata-core>= 1.0.0, < 1.8.1 → fixed in 1.8.1;org.apache.seata:seata-core= 2.0.0 → fixed in 2.1.0 - H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL CVE-2024-45758 CVSS 9.1 Critical
ai.h2o:h2o-core<= 3.46.0.7 → no fix listed;h2o<= 3.46.0.7 → no fix listed - Apache Dolphinscheduler Code Injection vulnerability CVE-2024-43202 CVSS 9.3 Critical
org.apache.dolphinscheduler:dolphinscheduler-task-api>= 3.1.0, < 3.2.2 → fixed in 3.2.2 - XWiki Platform allows XSS through XClass name in string properties CVE-2024-43400 CVSS 9.4 Critical
org.xwiki.platform:xwiki-platform-oldcore>= 1.1.2, < 14.10.21 → fixed in 14.10.21;org.xwiki.platform:xwiki-platform-oldcore>= 15.0-rc-1, < 15.5.5 → fixed in 15.5.5;org.xwiki.platform:xwiki-platform-oldcore>= 15.6-rc-1, < 15.10.6 → fixed in 15.10.6; +1 more packages - In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them CVE-2024-43401 CVSS 9.4 Critical
org.xwiki.platform:xwiki-platform-web-templates< 15.10-rc-1 → fixed in 15.10-rc-1 - CometVisu Backend for openHAB affected by RCE through path traversal CVE-2024-42469 CVSS 9.3 Critical
org.openhab.ui.bundles:org.openhab.ui.cometvisu<= 4.2.0 → fixed in 4.2.1 - XXL-RPC Deserialization of Untrusted Data vulnerability CVE-2023-45146 CVSS 9.5 Critical
com.xuxueli:xxl-rpc-core<= 1.7.0 → no fix listed - Redisson vulnerable to Deserialization of Untrusted Data CVE-2023-42809 CVSS 9.4 Critical
org.redisson:redisson< 3.22.0 → fixed in 3.22.0 - XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet CVE-2024-37901 CVSS 9.4 Critical
org.xwiki.platform:xwiki-platform-search-ui>= 9.2-rc-1, < 14.10.21 → fixed in 14.10.21;org.xwiki.platform:xwiki-platform-search-ui>= 15.0-rc-1, < 15.5.5 → fixed in 15.5.5;org.xwiki.platform:xwiki-platform-search-ui>= 15.6-rc-1, < 15.10.2 → fixed in 15.10.2 - XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution CVE-2024-41947 CVSS 9.4 Critical
org.xwiki.platform:xwiki-platform-web-templates>= 11.8-rc-1, < 15.10.8 → fixed in 15.10.8;org.xwiki.platform:xwiki-platform-web-templates>= 16.0.0-rc-1, < 16.3.0-rc-1 → fixed in 16.3.0-rc-1 - Remote code execution in Spring Cloud Data Flow CVE-2024-37084 CVSS 9.3 Critical
org.springframework.cloud:spring-cloud-skipper< 2.11.4 → fixed in 2.11.4 - Eclipse Parsson stack overflow when parsing deeply nested input CVE-2023-7272 CVSS 9.2 Critical
org.eclipse.parsson:parsson>= 1.1.0, < 1.1.3 → fixed in 1.1.3;org.eclipse.parsson:parsson< 1.0.4 → fixed in 1.0.4 - Remote Code Execution (RCE) vulnerability in geoserver CVE-2024-36401 CVSS 9.3 Critical
org.geoserver.web:gs-web-app>= 2.24.0, < 2.24.4 → fixed in 2.24.4;org.geoserver:gs-wfs>= 2.24.0, < 2.24.4 → fixed in 2.24.4;org.geoserver:gs-wms>= 2.24.0, < 2.24.4 → fixed in 2.24.4; +9 more packages - XWiki programming rights may be inherited by inclusion CVE-2024-38369 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-rendering-macro-include< 15.0-rc-1 → fixed in 15.0-rc-1 - Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation CVE-2024-29868 CVSS 9.1 Critical
org.apache.streampipes:streampipes-resource-management>= 0.69.0, < 0.95.0 → fixed in 0.95.0 - XWiki Platform allows remote code execution from user account CVE-2024-37899 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-oldcore>= 13.4.7, < 13.5 → fixed in 14.10.21;org.xwiki.platform:xwiki-platform-oldcore>= 13.10.3, < 14.10.21 → fixed in 14.10.21;org.xwiki.platform:xwiki-platform-oldcore>= 15.0-rc-1, < 15.5.5 → fixed in 15.5.5; +2 more packages - DeepJavaLibrary API absolute path traversal CVE-2024-37902 CVSS 10.0 Critical
ai.djl:api>= 0.1.0, < 0.28.0 → fixed in 0.28.0 - Apache Submarine Server Core Incorrect Authorization vulnerability CVE-2024-36265 CVSS 9.1 Critical
org.apache.submarine:submarine-server-core= 0.8.0 → no fix listed;apache-submarine= 0.8.0 → no fix listed - Silverpeas authentication bypass CVE-2024-36042 CVSS 9.8 Critical
org.silverpeas.core:silverpeas-core< 6.3.5 → fixed in 6.3.5 - Amazon JDBC Driver for Redshift SQL Injection via line comment generation CVE-2024-32888 CVSS 10.0 Critical
com.amazon.redshift:redshift-jdbc42< 2.1.0.28 → fixed in 2.1.0.28 - Apache Karaf Cave: Cave SSRF and arbitrary file access CVE-2024-34365 CVSS 9.1 Critical
org.apache.karaf:cave<= 4.1.2 → no fix listed - Genie Path Traversal vulnerability via File Uploads CVE-2024-4701 CVSS 9.9 Critical
com.netflix.genie:genie-web< 4.3.18 → fixed in 4.3.18 - Apache Inlong Deserialization of Untrusted Data vulnerability CVE-2024-26579 CVSS 9.8 Critical
org.apache.inlong:manager-pojo>= 1.7.0, < 1.12.0 → fixed in 1.12.0 - OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`) CVE-2024-28253 CVSS 9.4 Critical
org.open-metadata:openmetadata-service< 1.3.1 → fixed in 1.3.1 - Apache HugeGraph-Server: Command execution in gremlin CVE-2024-27348 CVSS 9.3 Critical
org.apache.hugegraph:hugegraph-api>= 1.0.0, < 1.3.0 → fixed in 1.3.0;org.apache.hugegraph:hugegraph-core>= 1.0.0, < 1.3.0 → fixed in 1.3.0 - XWiki Platform: Remote code execution from edit in multilingual wikis via translations CVE-2024-31983 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-localization-source-wiki>= 4.3-milestone-2, < 14.10.20 → fixed in 14.10.20;org.xwiki.platform:xwiki-platform-localization-source-wiki>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-localization-source-wiki>= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1 - XWiki Platform: Remote code execution through space title and Solr space facet CVE-2024-31984 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-search-solr-ui>= 7.2-rc-1, < 14.10.20 → fixed in 14.10.20;org.xwiki.platform:xwiki-platform-search-solr-ui>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-search-solr-ui>= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1 - XWiki Platform: Privilege escalation (PR) from user registration through PDFClass CVE-2024-31981 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-oldcore>= 3.0.1, < 14.10.20 → fixed in 14.10.20;org.xwiki.platform:xwiki-platform-oldcore>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-oldcore>= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1 - XWiki Platform CSRF remote code execution through the realtime HTML Converter API CVE-2024-31988 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-realtime-ui>= 13.9-rc-1, < 14.10.19 → fixed in 14.10.19;org.xwiki.platform:xwiki-platform-realtime-ui>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-realtime-ui>= 15.6-rc-1, < 15.9 → fixed in 15.9 - XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution CVE-2024-31996 CVSS 10.0 Critical
org.xwiki.commons:xwiki-commons-velocity>= 3.0.1, < 14.10.19 → fixed in 14.10.19;org.xwiki.commons:xwiki-commons-velocity>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.commons:xwiki-commons-velocity>= 15.6-rc-1, < 15.9-rc-1 → fixed in 15.9-rc-1 - XWiki Platform remote code execution from account via custom skins support CVE-2024-31987 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-oldcore>= 6.4-milestone-1, < 14.10.19 → fixed in 14.10.19;org.xwiki.platform:xwiki-platform-oldcore>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-oldcore>= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1 - XWiki Platform remote code execution from account through UIExtension parameters CVE-2024-31997 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-uiextension-api< 14.10.19 → fixed in 14.10.19;org.xwiki.platform:xwiki-platform-uiextension-api>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-uiextension-api>= 15.6-rc-1, < 15.9-rc-1 → fixed in 15.9-rc-1 - XWiki Platform CSRF remote code execution through scheduler job's document reference CVE-2024-31986 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-scheduler-ui>= 3.1, < 14.10.19 → fixed in 14.10.19;org.xwiki.platform:xwiki-platform-scheduler-ui>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-scheduler-ui>= 15.6-rc-1, < 15.9 → fixed in 15.9 - XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVE-2024-31465 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-search-ui>= 5.2-milestone-2, < 14.10.20 → fixed in 14.10.20;org.xwiki.platform:xwiki-platform-search-ui>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-search-ui>= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1 - XWiki Platform: Remote code execution as guest via DatabaseSearch CVE-2024-31982 CVSS 10.0 Critical
org.xwiki.platform:xwiki-platform-search-ui>= 2.4-milestone-1, < 14.10.20 → fixed in 14.10.20;org.xwiki.platform:xwiki-platform-search-ui>= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4;org.xwiki.platform:xwiki-platform-search-ui>= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1 - Improper escaping in Apache Zeppelin CVE-2024-31866 CVSS 9.3 Critical
org.apache.zeppelin:zeppelin-interpreter>= 0.8.2, < 0.11.1 → fixed in 0.11.1 - Apache Zeppelin remote code execution by adding malicious JDBC connection string CVE-2024-31864 CVSS 9.8 Critical
org.apache.zeppelin:zeppelin-jdbc< 0.11.1 → fixed in 0.11.1 - FitNesse allows execution of arbitrary OS commands CVE-2024-28125 CVSS 9.3 Critical
org.fitnesse:fitnesse<= 20240707 → no fix listed - SSRF vulnerability using the Aegis DataBinding in Apache CXF CVE-2024-28752 CVSS 9.3 Critical
org.apache.cxf:cxf-rt-databinding-aegis< 3.5.8 → fixed in 3.5.8;org.apache.cxf:cxf-rt-databinding-aegis>= 3.6.0, < 3.6.3 → fixed in 3.6.3;org.apache.cxf:cxf-rt-databinding-aegis>= 4.0.0, < 4.0.4 → fixed in 4.0.4 - Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVE-2024-27317 CVSS 9.9 Critical
org.apache.pulsar:pulsar-functions-worker>= 2.4.0, < 2.10.6 → fixed in 2.10.6;org.apache.pulsar:pulsar-functions-worker>= 2.11.0, < 2.11.4 → fixed in 2.11.4;org.apache.pulsar:pulsar-functions-worker>= 3.0.0, < 3.0.3 → fixed in 3.0.3; +2 more packages - Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability CVE-2024-26580 CVSS 9.3 Critical
org.apache.inlong:manager-common>= 1.8.0, < 1.11.0 → fixed in 1.11.0 - nGrinder vulnerable to unsafe Java objects deserialization CVE-2024-28213 CVSS 9.3 Critical
org.ngrinder:ngrinder-core< 3.5.9 → fixed in 3.5.9 - Apache James server: Privilege escalation via JMX pre-authentication deserialization CVE-2023-51518 CVSS 9.3 Critical
org.apache.james:james-server<= 3.7.4 → fixed in 3.7.5;org.apache.james:james-server>= 3.8.0, < 3.8.1 → fixed in 3.8.1 - SAML authentication bypass due to missing validation on unsigned SAML messages GHSA-hx5q-v6pj-533r CVSS 9.1 Critical
com.linecorp.centraldogma:centraldogma-server-auth-saml<= 0.64.2 → fixed in 0.64.3 - Armeria SAML authentication bypass due to missing validation on unsigned SAML messages CVE-2024-1735 CVSS 9.1 Critical
com.linecorp.armeria:armeria-saml<= 1.27.1 → fixed in 1.27.2 - Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2023-47795 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom>= 7.4.3.18, <= 7.4.3.101 → fixed in 7.4.3.102;com.liferay.portal:release.dxp.bom>= 2023.Q3, < 2023.Q3.6 → fixed in 2023.Q3.6;com.liferay.portal:release.dxp.bom>= 7.4.13.u18, <= 7.4.13.u92 → no fix listed - org.postgresql:postgresql vulnerable to SQL Injection via line comment generation CVE-2024-1597 CVSS 10.0 Critical
org.postgresql:postgresql< 42.2.28 → fixed in 42.2.28;org.postgresql:postgresql>= 42.3.0, < 42.3.9 → fixed in 42.3.9;org.postgresql:postgresql>= 42.4.0, < 42.4.4 → fixed in 42.4.4; +3 more packages - Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting CVE-2024-25147 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom<= 7.4.1 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4;com.liferay.portal:release.dxp.bom>= 7.2.0, < 7.2.10.fp15 → fixed in 7.2.10.fp15 - Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) CVE-2024-25610 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom< 7.4.3.13 → fixed in 7.4.3.13;com.liferay.portal:release.dxp.bom>= 7.4.0, < 7.4.13.u9 → fixed in 7.4.13.u9;com.liferay.portal:release.dxp.bom>= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; +2 more packages - Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting CVE-2024-25602 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom<= 7.4.2 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4;com.liferay.portal:release.dxp.bom>= 7.2.0, < 7.2.10.fp17 → fixed in 7.2.10.fp17 - Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-26266 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom<= 7.4.3.13 → fixed in 7.4.3.14;com.liferay.portal:release.dxp.bom>= 7.4.13.u1, < 7.4.13.u10 → fixed in 7.4.13.u10;com.liferay.portal:release.dxp.bom>= 7.3.10.ep3, < 7.3.10.u4 → fixed in 7.3.10.u4; +1 more packages - Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting CVE-2024-26269 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom>= 7.2.0, <= 7.4.3.37 → fixed in 7.4.3.38;com.liferay.portal:release.dxp.bom>= 7.4.13.u1, < 7.4.13.u38 → fixed in 7.4.13.u38;com.liferay.portal:release.dxp.bom>= 7.3.10.ep3, < 7.3.10.u11 → fixed in 7.3.10.u11; +1 more packages - Remote Code Execution in Apache Dolphinscheduler CVE-2023-49109 CVSS 9.8 Critical
org.apache.dolphinscheduler:dolphinscheduler>= 3.0.0, < 3.2.1 → fixed in 3.2.1 - Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-25152 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom<= 7.4.2 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4;com.liferay.portal:release.dxp.bom>= 7.2.0, < 7.2.10.fp17 → fixed in 7.2.10.fp17 - Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-25601 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom<= 7.4.2 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4;com.liferay.portal:release.dxp.bom>= 7.2.0, < 7.2.10.fp17 → fixed in 7.2.10.fp17 - Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting CVE-2023-42498 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom>= 7.4.3.8, <= 7.4.3.97 → fixed in 7.4.3.98;com.liferay.portal:release.dxp.bom>= 2023.Q3, < 2023.Q3.5 → fixed in 2023.Q3.5;com.liferay.portal:release.dxp.bom>= 7.4.13.u4, <= 7.4.13.u92 → no fix listed - Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting CVE-2023-42496 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom>= 7.3.3, <= 7.4.3.97 → fixed in 7.4.3.98;com.liferay.portal:release.dxp.bom>= 7.4.10.ep1, <= 7.4.13.u92 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.3.10.ep3, < 7.3.10.u34 → fixed in 7.3.10.u34; +1 more packages - Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting CVE-2023-40191 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom>= 7.4.3.44, <= 7.4.3.97 → fixed in 7.4.3.98;com.liferay.portal:release.dxp.bom>= 2023.Q3, < 2023.Q3.6 → fixed in 2023.Q3.6;com.liferay.portal:release.dxp.bom>= 7.4.13.u44, <= 7.4.13.u92 → no fix listed - Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-25603 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom<= 7.4.3.4 → fixed in 7.4.3.5;com.liferay.portal:release.dxp.bom>= 7.4.13.u1, <= 7.4.13.u102 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.3.10.ep3, < 7.3.10.u4 → fixed in 7.3.10.u4; +1 more packages - Liferay Portal stored cross-site scripting (XSS) vulnerability CVE-2024-25145 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom< 7.4.3.12 → fixed in 7.4.3.12;com.liferay.portal:release.dxp.bom>= 7.4.0, < 7.4.3.13u8 → fixed in 7.4.3.13u8;com.liferay.portal:release.dxp.bom>= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; +1 more packages - Central Dogma Authentication Bypass Vulnerability via Session Leakage CVE-2024-1143 CVSS 9.3 Critical
com.linecorp.centraldogma:centraldogma-server< 0.64.1 → fixed in 0.64.1 - Beetl Server-Side Template Injection vulnerability CVE-2024-22533 CVSS 9.8 Critical
com.ibeetl:beetl-core< 3.15.13.RELEASE → fixed in 3.15.13.RELEASE - Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE CVE-2024-23897 CVSS 9.3 Critical
org.jenkins-ci.main:jenkins-core>= 1.606, <= 2.426.2 → fixed in 2.426.3;org.jenkins-ci.main:jenkins-core= 2.441 → fixed in 2.442;org.jenkins-ci.main:jenkins-core>= 2.427, < 2.440.1 → fixed in 2.440.1 - Remote Command Execution in SOFARPC CVE-2024-23636 CVSS 9.8 Critical
com.alipay.sofa:rpc-sofa-boot-starter< 5.12.0 → fixed in 5.12.0 - Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization CVE-2017-20189 CVSS 9.8 Critical
org.clojure:clojure< 1.9.0 → fixed in 1.9.0 - XWiki Remote Code Execution Vulnerability via User Registration CVE-2024-21650 CVSS 10.0 Critical
org.xwiki.platform:xwiki-platform-administration-ui>= 2.2, < 14.10.17 → fixed in 14.10.17;org.xwiki.platform:xwiki-platform-administration-ui>= 15.0-rc-1, < 15.5.3 → fixed in 15.5.3;org.xwiki.platform:xwiki-platform-administration-ui>= 15.6-rc-1, < 15.8-rc-1 → fixed in 15.8-rc-1 - Apache InLong Manager Remote Code Execution vulnerability CVE-2023-51784 CVSS 9.8 Critical
org.apache.inlong:manager-pojo>= 1.5.0, < 1.10.0 → fixed in 1.10.0 - Jeecg Boot SQL Injection CVE-2023-41543 CVSS 9.8 Critical
org.jeecgframework.boot:jeecg-boot-common<= 3.5.3 → no fix listed - Jeecg Boot SQL injection vulnerability CVE-2023-41542 CVSS 9.8 Critical
org.jeecgframework.boot:jeecg-boot-common<= 3.5.3 → no fix listed - JeecgBoot server-side template injection CVE-2023-41544 CVSS 9.1 Critical
org.jeecgframework.boot:jeecg-boot-common<= 3.5.3 → no fix listed - hyavijava stack overflow vulnerability CVE-2023-51084 CVSS 9.8 Critical
com.github:hyavijava<= 6.0.07.1 → no fix listed - Apache IoTDB: Unsafe deserialize map in Sync Tool CVE-2023-51656 CVSS 9.8 Critical
org.apache.iotdb:iotdb-parent>= 0.13.0, < 1.2.2 → fixed in 1.2.2 - Remote code execution/programming rights with configuration section from any user account CVE-2023-50723 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-administration-ui>= 2.3, < 14.10.15 → fixed in 14.10.15;org.xwiki.platform:xwiki-platform-administration-ui>= 15.0-rc-1, < 15.5.2 → fixed in 15.5.2;org.xwiki.platform:xwiki-platform-administration-ui>= 15.6-rc-1, < 15.7-rc-1 → fixed in 15.7-rc-1 - Apache StreamPark: Authenticated system users could trigger remote command execution CVE-2023-49898
org.apache.streampark:streampark>= 2.0.0, < 2.1.2 → fixed in 2.1.2 - XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass CVE-2023-50722 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-administration-ui>= 2.3, < 14.10.15 → fixed in 14.10.15;org.xwiki.platform:xwiki-platform-administration-ui>= 15.0-rc-1, < 15.5.2 → fixed in 15.5.2;org.xwiki.platform:xwiki-platform-administration-ui>= 15.6-rc-1, < 15.7-rc-1 → fixed in 15.7-rc-1 - Apache Dubbo: Bypass deny serialize list check in Apache Dubbo CVE-2023-46279 CVSS 9.8 Critical
org.apache.dubbo:dubbo= 3.1.5 → fixed in 3.1.6 - Remote code execution from account through SearchAdmin CVE-2023-50721 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-search-ui>= 4.5-rc-1, < 14.10.15 → fixed in 14.10.15;org.xwiki.platform:xwiki-platform-search-ui>= 15.0-rc-1, < 15.5.2 → fixed in 15.5.2;org.xwiki.platform:xwiki-platform-search-ui>= 15.6-rc-1, < 15.7-rc-1 → fixed in 15.7-rc-1 - Bypass serialize checks in Apache Dubbo CVE-2023-29234 CVSS 9.8 Critical
org.apache.dubbo:dubbo>= 3.1.0, < 3.1.11 → fixed in 3.1.11;org.apache.dubbo:dubbo>= 3.2.0, < 3.2.5 → fixed in 3.2.5 - Improper JWT Signature Validation in SAP Security Services Library CVE-2023-50422 CVSS 9.3 Critical
com.sap.cloud.security:java-security< 2.17.0 → fixed in 2.17.0;com.sap.cloud.security:java-security>= 3.0.0, < 3.3.0 → fixed in 3.3.0;com.sap.cloud.security:spring-security< 2.17.0 → fixed in 2.17.0; +3 more packages - Apache Struts vulnerable to path traversal CVE-2023-50164 CVSS 9.8 Critical
org.apache.struts:struts2-core>= 6.0.0, < 6.3.0.2 → fixed in 6.3.0.2;org.apache.struts:struts2-core>= 2.0.0, < 2.5.33 → fixed in 2.5.33 - Solon is vulnerable to Deserialization of Untrusted Data CVE-2023-48967 CVSS 9.8 Critical
org.noear:solon<= 2.6.0 → no fix listed - Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download CVE-2023-48910 CVSS 9.8 Critical
io.github.microcks:microcks< 1.17.1 → fixed in 1.17.1 - HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL CVE-2023-49093 CVSS 9.8 Critical
org.htmlunit:htmlunit< 3.9.0 → fixed in 3.9.0 - RuoYi vulnerable to SQL injection vulnerability CVE-2023-49371 CVSS 9.8 Critical
com.ruoyi:ruoyi<= 4.6 → no fix listed