---
title: "Critical Maven advisories (page 3)"
url: https://erroneo.us/security/ecosystem/maven/3/
description: "All 334 critical GitHub-reviewed Maven security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 3 of 4."
type: ecosystem
section: "Security Digest"
date_modified: 2024-12-12
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Maven advisories (page 3)

- 2024-12-12 [CVE-2024-55877](https://erroneo.us/security/cve/CVE-2024-55877/index.md) XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList — org.xwiki.platform:xwiki-platform-help-ui >= 9.7-rc-1, < 15.10.11 → 15.10.11; org.xwiki.platform:xwiki-platform-help-ui >= 16.0.0-rc-1, < 16.4.1 → 16.4.1; org.xwiki.platform:xwiki-platform-help-ui >= 16.5.0-rc-1, < 16.5.0 → 16.5.0
- 2024-12-11 [CVE-2024-53677](https://erroneo.us/security/cve/CVE-2024-53677/index.md) Apache Struts file upload logic is flawed — org.apache.struts:struts2-core < 6.4.0 → 6.4.0
- 2024-12-02 [CVE-2024-53990](https://erroneo.us/security/cve/CVE-2024-53990/index.md) AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s — org.asynchttpclient:async-http-client >= 2.1.0, < 2.12.4 → 2.12.4; org.asynchttpclient:async-http-client >= 3.0.0.Beta1, < 3.0.1 → 3.0.1
- 2024-11-18 [CVE-2024-52316](https://erroneo.us/security/cve/CVE-2024-52316/index.md) Apache Tomcat - Authentication Bypass — org.apache.tomcat:tomcat-catalina < 9.0.96 → 9.0.96; org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.30 → 10.1.30; org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, <= 11.0.0-M26 → 11.0.1
- 2024-10-28 [CVE-2024-38821](https://erroneo.us/security/cve/CVE-2024-38821/index.md) Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications — org.springframework.security:spring-security-web >= 5.8.0, < 5.8.15 → 5.8.15; org.springframework.security:spring-security-web >= 6.2.0, < 6.2.7 → 6.2.7; org.springframework.security:spring-security-web >= 6.0.0, < 6.0.13 → 6.0.13
- 2024-10-24 [CVE-2024-47883](https://erroneo.us/security/cve/CVE-2024-47883/index.md) Butterfly has path/URL confusion in resource handling leading to multiple weaknesses — org.openrefine.dependencies:butterfly < 1.2.6 → 1.2.6
- 2024-10-22 [CVE-2024-8980](https://erroneo.us/security/cve/CVE-2024-8980/index.md) Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console — com.liferay.portal:release.portal.bom >= 7.0.0-a1, < 7.4.3.102-GA102 → 7.4.3.102-GA102; com.liferay.portal:release.dxp.bom >= 2023.Q3.1, < 2023.Q3.5 → 2023.Q3.5; com.liferay.portal:release.dxp.bom >= 7.0.0-GA, <= 7.0.10.fp102 → no fix
- 2024-10-22 [CVE-2024-38002](https://erroneo.us/security/cve/CVE-2024-38002/index.md) Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions — com.liferay.portal:release.portal.bom >= 7.3.2-ga3, < 7.4.3.112-ga112 → 7.4.3.112-ga112; com.liferay.portal:release.dxp.bom >= 2023.Q4.0, < 2023.Q4.6 → 2023.Q4.6; com.liferay.portal:release.dxp.bom >= 2023.Q3.1, < 2023.Q3.9 → 2023.Q3.9
- 2024-10-16 [CVE-2024-45216](https://erroneo.us/security/cve/CVE-2024-45216/index.md) Improper Authentication vulnerability in Apache Solr — org.apache.solr:solr >= 5.3.0, < 8.11.4 → 8.11.4; org.apache.solr:solr >= 9.0.0, < 9.7.0 → 9.7.0
- 2024-10-11 [CVE-2024-21534](https://erroneo.us/security/cve/CVE-2024-21534/index.md) JSONPath Plus Remote Code Execution (RCE) Vulnerability — org.webjars.npm:jsonpath-plus <= 6.0.1 → no fix; jsonpath-plus < 10.2.0 → 10.2.0
- 2024-10-11 [CVE-2023-25581](https://erroneo.us/security/cve/CVE-2023-25581/index.md) pac4j-core affected by a Java deserialization vulnerability — org.pac4j:pac4j-core < 4.0.0 → 4.0.0
- 2024-10-03 [CVE-2024-47561](https://erroneo.us/security/cve/CVE-2024-47561/index.md) Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK) — org.apache.avro:avro < 1.11.4 → 1.11.4
- 2024-10-02 [CVE-2024-47807](https://erroneo.us/security/cve/CVE-2024-47807/index.md) Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation — org.jenkins-ci.plugins:oic-auth < 4.355.v3a → 4.355.v3a
- 2024-10-02 [CVE-2024-47806](https://erroneo.us/security/cve/CVE-2024-47806/index.md) Jenkins OpenId Connect Authentication Plugin lacks audience claim validation — org.jenkins-ci.plugins:oic-auth < 4.355.v3a → 4.355.v3a
- 2024-09-23 [CVE-2024-46997](https://erroneo.us/security/cve/CVE-2024-46997/index.md) DataEase's H2 datasource has a remote command execution risk — io.dataease:common <= 2.10.0 → 2.10.1
- 2024-09-17 [GHSA-2gh6-wc3m-g37f](https://erroneo.us/security/ghsa/GHSA-2gh6-wc3m-g37f/index.md) hermes-management is vulnerable to RCE due to Apache commons-jxpath — pl.allegro.tech.hermes:hermes-management >= 0.8.2, < 2.2.9 → 2.2.9
- 2024-09-16 [CVE-2024-22399](https://erroneo.us/security/cve/CVE-2024-22399/index.md) Apache Seata Deserialization of Untrusted Data vulnerability — org.apache.seata:seata-core >= 1.0.0, < 1.8.1 → 1.8.1; org.apache.seata:seata-core = 2.0.0 → 2.1.0
- 2024-09-06 [CVE-2024-45758](https://erroneo.us/security/cve/CVE-2024-45758/index.md) H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL — ai.h2o:h2o-core <= 3.46.0.7 → no fix; h2o <= 3.46.0.7 → no fix
- 2024-08-20 [CVE-2024-43202](https://erroneo.us/security/cve/CVE-2024-43202/index.md) Apache Dolphinscheduler Code Injection vulnerability — org.apache.dolphinscheduler:dolphinscheduler-task-api >= 3.1.0, < 3.2.2 → 3.2.2
- 2024-08-19 [CVE-2024-43400](https://erroneo.us/security/cve/CVE-2024-43400/index.md) XWiki Platform allows XSS through XClass name in string properties — org.xwiki.platform:xwiki-platform-oldcore >= 1.1.2, < 14.10.21 → 14.10.21; org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.5 → 15.5.5; org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10.6 → 15.10.6
- 2024-08-19 [CVE-2024-43401](https://erroneo.us/security/cve/CVE-2024-43401/index.md) In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them — org.xwiki.platform:xwiki-platform-web-templates < 15.10-rc-1 → 15.10-rc-1
- 2024-08-09 [CVE-2024-42469](https://erroneo.us/security/cve/CVE-2024-42469/index.md) CometVisu Backend for openHAB affected by RCE through path traversal — org.openhab.ui.bundles:org.openhab.ui.cometvisu <= 4.2.0 → 4.2.1
- 2024-08-05 [CVE-2023-45146](https://erroneo.us/security/cve/CVE-2023-45146/index.md) XXL-RPC Deserialization of Untrusted Data vulnerability — com.xuxueli:xxl-rpc-core <= 1.7.0 → no fix
- 2024-08-05 [CVE-2023-42809](https://erroneo.us/security/cve/CVE-2023-42809/index.md) Redisson vulnerable to Deserialization of Untrusted Data — org.redisson:redisson < 3.22.0 → 3.22.0
- 2024-07-31 [CVE-2024-37901](https://erroneo.us/security/cve/CVE-2024-37901/index.md) XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet — org.xwiki.platform:xwiki-platform-search-ui >= 9.2-rc-1, < 14.10.21 → 14.10.21; org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.5 → 15.5.5; org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.10.2 → 15.10.2
- 2024-07-31 [CVE-2024-41947](https://erroneo.us/security/cve/CVE-2024-41947/index.md) XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution — org.xwiki.platform:xwiki-platform-web-templates >= 11.8-rc-1, < 15.10.8 → 15.10.8; org.xwiki.platform:xwiki-platform-web-templates >= 16.0.0-rc-1, < 16.3.0-rc-1 → 16.3.0-rc-1
- 2024-07-25 [CVE-2024-37084](https://erroneo.us/security/cve/CVE-2024-37084/index.md) Remote code execution in Spring Cloud Data Flow — org.springframework.cloud:spring-cloud-skipper < 2.11.4 → 2.11.4
- 2024-07-17 [CVE-2023-7272](https://erroneo.us/security/cve/CVE-2023-7272/index.md) Eclipse Parsson stack overflow when parsing deeply nested input — org.eclipse.parsson:parsson >= 1.1.0, < 1.1.3 → 1.1.3; org.eclipse.parsson:parsson < 1.0.4 → 1.0.4
- 2024-07-01 [CVE-2024-36401](https://erroneo.us/security/cve/CVE-2024-36401/index.md) Remote Code Execution (RCE) vulnerability in geoserver — org.geoserver.web:gs-web-app >= 2.24.0, < 2.24.4 → 2.24.4; org.geoserver:gs-wfs >= 2.24.0, < 2.24.4 → 2.24.4; org.geoserver:gs-wms >= 2.24.0, < 2.24.4 → 2.24.4
- 2024-06-24 [CVE-2024-38369](https://erroneo.us/security/cve/CVE-2024-38369/index.md) XWiki programming rights may be inherited by inclusion — org.xwiki.platform:xwiki-platform-rendering-macro-include < 15.0-rc-1 → 15.0-rc-1
- 2024-06-24 [CVE-2024-29868](https://erroneo.us/security/cve/CVE-2024-29868/index.md) Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation — org.apache.streampipes:streampipes-resource-management >= 0.69.0, < 0.95.0 → 0.95.0
- 2024-06-20 [CVE-2024-37899](https://erroneo.us/security/cve/CVE-2024-37899/index.md) XWiki Platform allows remote code execution from user account — org.xwiki.platform:xwiki-platform-oldcore >= 13.4.7, < 13.5 → 14.10.21; org.xwiki.platform:xwiki-platform-oldcore >= 13.10.3, < 14.10.21 → 14.10.21; org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.5 → 15.5.5
- 2024-06-17 [CVE-2024-37902](https://erroneo.us/security/cve/CVE-2024-37902/index.md) DeepJavaLibrary API absolute path traversal — ai.djl:api >= 0.1.0, < 0.28.0 → 0.28.0
- 2024-06-12 [CVE-2024-36265](https://erroneo.us/security/cve/CVE-2024-36265/index.md) Apache Submarine Server Core Incorrect Authorization vulnerability — org.apache.submarine:submarine-server-core = 0.8.0 → no fix; apache-submarine = 0.8.0 → no fix
- 2024-06-02 [CVE-2024-36042](https://erroneo.us/security/cve/CVE-2024-36042/index.md) Silverpeas authentication bypass — org.silverpeas.core:silverpeas-core < 6.3.5 → 6.3.5
- 2024-05-15 [CVE-2024-32888](https://erroneo.us/security/cve/CVE-2024-32888/index.md) Amazon JDBC Driver for Redshift SQL Injection via line comment generation — com.amazon.redshift:redshift-jdbc42 < 2.1.0.28 → 2.1.0.28
- 2024-05-14 [CVE-2024-34365](https://erroneo.us/security/cve/CVE-2024-34365/index.md) Apache Karaf Cave: Cave SSRF and arbitrary file access — org.apache.karaf:cave <= 4.1.2 → no fix
- 2024-05-09 [CVE-2024-4701](https://erroneo.us/security/cve/CVE-2024-4701/index.md) Genie Path Traversal vulnerability via File Uploads — com.netflix.genie:genie-web < 4.3.18 → 4.3.18
- 2024-05-08 [CVE-2024-26579](https://erroneo.us/security/cve/CVE-2024-26579/index.md) Apache Inlong Deserialization of Untrusted Data vulnerability — org.apache.inlong:manager-pojo >= 1.7.0, < 1.12.0 → 1.12.0
- 2024-04-23 [CVE-2024-28253](https://erroneo.us/security/cve/CVE-2024-28253/index.md) OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`) — org.open-metadata:openmetadata-service < 1.3.1 → 1.3.1
- 2024-04-22 [CVE-2024-27348](https://erroneo.us/security/cve/CVE-2024-27348/index.md) Apache HugeGraph-Server: Command execution in gremlin — org.apache.hugegraph:hugegraph-api >= 1.0.0, < 1.3.0 → 1.3.0; org.apache.hugegraph:hugegraph-core >= 1.0.0, < 1.3.0 → 1.3.0
- 2024-04-10 [CVE-2024-31983](https://erroneo.us/security/cve/CVE-2024-31983/index.md) XWiki Platform: Remote code execution from edit in multilingual wikis via translations — org.xwiki.platform:xwiki-platform-localization-source-wiki >= 4.3-milestone-2, < 14.10.20 → 14.10.20; org.xwiki.platform:xwiki-platform-localization-source-wiki >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-localization-source-wiki >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1
- 2024-04-10 [CVE-2024-31984](https://erroneo.us/security/cve/CVE-2024-31984/index.md) XWiki Platform: Remote code execution through space title and Solr space facet — org.xwiki.platform:xwiki-platform-search-solr-ui >= 7.2-rc-1, < 14.10.20 → 14.10.20; org.xwiki.platform:xwiki-platform-search-solr-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-search-solr-ui >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1
- 2024-04-10 [CVE-2024-31981](https://erroneo.us/security/cve/CVE-2024-31981/index.md) XWiki Platform: Privilege escalation (PR) from user registration through PDFClass — org.xwiki.platform:xwiki-platform-oldcore >= 3.0.1, < 14.10.20 → 14.10.20; org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1
- 2024-04-10 [CVE-2024-31988](https://erroneo.us/security/cve/CVE-2024-31988/index.md) XWiki Platform CSRF remote code execution through the realtime HTML Converter API — org.xwiki.platform:xwiki-platform-realtime-ui >= 13.9-rc-1, < 14.10.19 → 14.10.19; org.xwiki.platform:xwiki-platform-realtime-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-realtime-ui >= 15.6-rc-1, < 15.9 → 15.9
- 2024-04-10 [CVE-2024-31996](https://erroneo.us/security/cve/CVE-2024-31996/index.md) XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution — org.xwiki.commons:xwiki-commons-velocity >= 3.0.1, < 14.10.19 → 14.10.19; org.xwiki.commons:xwiki-commons-velocity >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.commons:xwiki-commons-velocity >= 15.6-rc-1, < 15.9-rc-1 → 15.9-rc-1
- 2024-04-10 [CVE-2024-31987](https://erroneo.us/security/cve/CVE-2024-31987/index.md) XWiki Platform remote code execution from account via custom skins support — org.xwiki.platform:xwiki-platform-oldcore >= 6.4-milestone-1, < 14.10.19 → 14.10.19; org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1
- 2024-04-10 [CVE-2024-31997](https://erroneo.us/security/cve/CVE-2024-31997/index.md) XWiki Platform remote code execution from account through UIExtension parameters — org.xwiki.platform:xwiki-platform-uiextension-api < 14.10.19 → 14.10.19; org.xwiki.platform:xwiki-platform-uiextension-api >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-uiextension-api >= 15.6-rc-1, < 15.9-rc-1 → 15.9-rc-1
- 2024-04-10 [CVE-2024-31986](https://erroneo.us/security/cve/CVE-2024-31986/index.md) XWiki Platform CSRF remote code execution through scheduler job's document reference — org.xwiki.platform:xwiki-platform-scheduler-ui >= 3.1, < 14.10.19 → 14.10.19; org.xwiki.platform:xwiki-platform-scheduler-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-scheduler-ui >= 15.6-rc-1, < 15.9 → 15.9
- 2024-04-10 [CVE-2024-31465](https://erroneo.us/security/cve/CVE-2024-31465/index.md) XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet — org.xwiki.platform:xwiki-platform-search-ui >= 5.2-milestone-2, < 14.10.20 → 14.10.20; org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1
- 2024-04-10 [CVE-2024-31982](https://erroneo.us/security/cve/CVE-2024-31982/index.md) XWiki Platform: Remote code execution as guest via DatabaseSearch — org.xwiki.platform:xwiki-platform-search-ui >= 2.4-milestone-1, < 14.10.20 → 14.10.20; org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.4 → 15.5.4; org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.10-rc-1 → 15.10-rc-1
- 2024-04-09 [CVE-2024-31866](https://erroneo.us/security/cve/CVE-2024-31866/index.md) Improper escaping in Apache Zeppelin — org.apache.zeppelin:zeppelin-interpreter >= 0.8.2, < 0.11.1 → 0.11.1
- 2024-04-09 [CVE-2024-31864](https://erroneo.us/security/cve/CVE-2024-31864/index.md) Apache Zeppelin remote code execution by adding malicious JDBC connection string — org.apache.zeppelin:zeppelin-jdbc < 0.11.1 → 0.11.1
- 2024-03-18 [CVE-2024-28125](https://erroneo.us/security/cve/CVE-2024-28125/index.md) FitNesse allows execution of arbitrary OS commands — org.fitnesse:fitnesse <= 20240707 → no fix
- 2024-03-15 [CVE-2024-28752](https://erroneo.us/security/cve/CVE-2024-28752/index.md) SSRF vulnerability using the Aegis DataBinding in Apache CXF — org.apache.cxf:cxf-rt-databinding-aegis < 3.5.8 → 3.5.8; org.apache.cxf:cxf-rt-databinding-aegis >= 3.6.0, < 3.6.3 → 3.6.3; org.apache.cxf:cxf-rt-databinding-aegis >= 4.0.0, < 4.0.4 → 4.0.4
- 2024-03-12 [CVE-2024-27317](https://erroneo.us/security/cve/CVE-2024-27317/index.md) Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification — org.apache.pulsar:pulsar-functions-worker >= 2.4.0, < 2.10.6 → 2.10.6; org.apache.pulsar:pulsar-functions-worker >= 2.11.0, < 2.11.4 → 2.11.4; org.apache.pulsar:pulsar-functions-worker >= 3.0.0, < 3.0.3 → 3.0.3
- 2024-03-06 [CVE-2024-26580](https://erroneo.us/security/cve/CVE-2024-26580/index.md) Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability — org.apache.inlong:manager-common >= 1.8.0, < 1.11.0 → 1.11.0
- 2024-03-06 [CVE-2024-28213](https://erroneo.us/security/cve/CVE-2024-28213/index.md) nGrinder vulnerable to unsafe Java objects deserialization — org.ngrinder:ngrinder-core < 3.5.9 → 3.5.9
- 2024-02-27 [CVE-2023-51518](https://erroneo.us/security/cve/CVE-2023-51518/index.md) Apache James server: Privilege escalation via JMX pre-authentication deserialization — org.apache.james:james-server <= 3.7.4 → 3.7.5; org.apache.james:james-server >= 3.8.0, < 3.8.1 → 3.8.1
- 2024-02-26 [GHSA-hx5q-v6pj-533r](https://erroneo.us/security/ghsa/GHSA-hx5q-v6pj-533r/index.md) SAML authentication bypass due to missing validation on unsigned SAML messages — com.linecorp.centraldogma:centraldogma-server-auth-saml <= 0.64.2 → 0.64.3
- 2024-02-26 [CVE-2024-1735](https://erroneo.us/security/cve/CVE-2024-1735/index.md) Armeria SAML authentication bypass due to missing validation on unsigned SAML messages — com.linecorp.armeria:armeria-saml <= 1.27.1 → 1.27.2
- 2024-02-21 [CVE-2023-47795](https://erroneo.us/security/cve/CVE-2023-47795/index.md) Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting — com.liferay.portal:release.portal.bom >= 7.4.3.18, <= 7.4.3.101 → 7.4.3.102; com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.6 → 2023.Q3.6; com.liferay.portal:release.dxp.bom >= 7.4.13.u18, <= 7.4.13.u92 → no fix
- 2024-02-21 [CVE-2024-1597](https://erroneo.us/security/cve/CVE-2024-1597/index.md) org.postgresql:postgresql vulnerable to SQL Injection via line comment generation — org.postgresql:postgresql < 42.2.28 → 42.2.28; org.postgresql:postgresql >= 42.3.0, < 42.3.9 → 42.3.9; org.postgresql:postgresql >= 42.4.0, < 42.4.4 → 42.4.4
- 2024-02-20 [CVE-2024-25147](https://erroneo.us/security/cve/CVE-2024-25147/index.md) Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting — com.liferay.portal:release.portal.bom <= 7.4.1 → no fix; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp15 → 7.2.10.fp15
- 2024-02-20 [CVE-2024-25610](https://erroneo.us/security/cve/CVE-2024-25610/index.md) Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) — com.liferay.portal:release.portal.bom < 7.4.3.13 → 7.4.3.13; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u9 → 7.4.13.u9; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4
- 2024-02-20 [CVE-2024-25602](https://erroneo.us/security/cve/CVE-2024-25602/index.md) Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting — com.liferay.portal:release.portal.bom <= 7.4.2 → no fix; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → 7.2.10.fp17
- 2024-02-20 [CVE-2024-26266](https://erroneo.us/security/cve/CVE-2024-26266/index.md) Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting — com.liferay.portal:release.portal.bom <= 7.4.3.13 → 7.4.3.14; com.liferay.portal:release.dxp.bom >= 7.4.13.u1, < 7.4.13.u10 → 7.4.13.u10; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u4 → 7.3.10.u4
- 2024-02-20 [CVE-2024-26269](https://erroneo.us/security/cve/CVE-2024-26269/index.md) Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting — com.liferay.portal:release.portal.bom >= 7.2.0, <= 7.4.3.37 → 7.4.3.38; com.liferay.portal:release.dxp.bom >= 7.4.13.u1, < 7.4.13.u38 → 7.4.13.u38; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u11 → 7.3.10.u11
- 2024-02-20 [CVE-2023-49109](https://erroneo.us/security/cve/CVE-2023-49109/index.md) Remote Code Execution in Apache Dolphinscheduler — org.apache.dolphinscheduler:dolphinscheduler >= 3.0.0, < 3.2.1 → 3.2.1
- 2024-02-20 [CVE-2024-25152](https://erroneo.us/security/cve/CVE-2024-25152/index.md) Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting — com.liferay.portal:release.portal.bom <= 7.4.2 → no fix; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → 7.2.10.fp17
- 2024-02-20 [CVE-2024-25601](https://erroneo.us/security/cve/CVE-2024-25601/index.md) Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting — com.liferay.portal:release.portal.bom <= 7.4.2 → no fix; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → 7.2.10.fp17
- 2024-02-20 [CVE-2023-42498](https://erroneo.us/security/cve/CVE-2023-42498/index.md) Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting — com.liferay.portal:release.portal.bom >= 7.4.3.8, <= 7.4.3.97 → 7.4.3.98; com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.5 → 2023.Q3.5; com.liferay.portal:release.dxp.bom >= 7.4.13.u4, <= 7.4.13.u92 → no fix
- 2024-02-20 [CVE-2023-42496](https://erroneo.us/security/cve/CVE-2023-42496/index.md) Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting — com.liferay.portal:release.portal.bom >= 7.3.3, <= 7.4.3.97 → 7.4.3.98; com.liferay.portal:release.dxp.bom >= 7.4.10.ep1, <= 7.4.13.u92 → no fix; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u34 → 7.3.10.u34
- 2024-02-20 [CVE-2023-40191](https://erroneo.us/security/cve/CVE-2023-40191/index.md) Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting — com.liferay.portal:release.portal.bom >= 7.4.3.44, <= 7.4.3.97 → 7.4.3.98; com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.6 → 2023.Q3.6; com.liferay.portal:release.dxp.bom >= 7.4.13.u44, <= 7.4.13.u92 → no fix
- 2024-02-20 [CVE-2024-25603](https://erroneo.us/security/cve/CVE-2024-25603/index.md) Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting — com.liferay.portal:release.portal.bom <= 7.4.3.4 → 7.4.3.5; com.liferay.portal:release.dxp.bom >= 7.4.13.u1, <= 7.4.13.u102 → no fix; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u4 → 7.3.10.u4
- 2024-02-07 [CVE-2024-25145](https://erroneo.us/security/cve/CVE-2024-25145/index.md) Liferay Portal stored cross-site scripting (XSS) vulnerability — com.liferay.portal:release.portal.bom < 7.4.3.12 → 7.4.3.12; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.3.13u8 → 7.4.3.13u8; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4
- 2024-02-02 [CVE-2024-1143](https://erroneo.us/security/cve/CVE-2024-1143/index.md) Central Dogma Authentication Bypass Vulnerability via Session Leakage — com.linecorp.centraldogma:centraldogma-server < 0.64.1 → 0.64.1
- 2024-02-01 [CVE-2024-22533](https://erroneo.us/security/cve/CVE-2024-22533/index.md) Beetl Server-Side Template Injection vulnerability — com.ibeetl:beetl-core < 3.15.13.RELEASE → 3.15.13.RELEASE
- 2024-01-24 [CVE-2024-23897](https://erroneo.us/security/cve/CVE-2024-23897/index.md) Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE — org.jenkins-ci.main:jenkins-core >= 1.606, <= 2.426.2 → 2.426.3; org.jenkins-ci.main:jenkins-core = 2.441 → 2.442; org.jenkins-ci.main:jenkins-core >= 2.427, < 2.440.1 → 2.440.1
- 2024-01-23 [CVE-2024-23636](https://erroneo.us/security/cve/CVE-2024-23636/index.md) Remote Command Execution in SOFARPC — com.alipay.sofa:rpc-sofa-boot-starter < 5.12.0 → 5.12.0
- 2024-01-21 [CVE-2017-20189](https://erroneo.us/security/cve/CVE-2017-20189/index.md) Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization — org.clojure:clojure < 1.9.0 → 1.9.0
- 2024-01-08 [CVE-2024-21650](https://erroneo.us/security/cve/CVE-2024-21650/index.md) XWiki Remote Code Execution Vulnerability via User Registration — org.xwiki.platform:xwiki-platform-administration-ui >= 2.2, < 14.10.17 → 14.10.17; org.xwiki.platform:xwiki-platform-administration-ui >= 15.0-rc-1, < 15.5.3 → 15.5.3; org.xwiki.platform:xwiki-platform-administration-ui >= 15.6-rc-1, < 15.8-rc-1 → 15.8-rc-1
- 2024-01-03 [CVE-2023-51784](https://erroneo.us/security/cve/CVE-2023-51784/index.md) Apache InLong Manager Remote Code Execution vulnerability — org.apache.inlong:manager-pojo >= 1.5.0, < 1.10.0 → 1.10.0
- 2023-12-29 [CVE-2023-41543](https://erroneo.us/security/cve/CVE-2023-41543/index.md) Jeecg Boot SQL Injection — org.jeecgframework.boot:jeecg-boot-common <= 3.5.3 → no fix
- 2023-12-29 [CVE-2023-41542](https://erroneo.us/security/cve/CVE-2023-41542/index.md) Jeecg Boot SQL injection vulnerability — org.jeecgframework.boot:jeecg-boot-common <= 3.5.3 → no fix
- 2023-12-29 [CVE-2023-41544](https://erroneo.us/security/cve/CVE-2023-41544/index.md) JeecgBoot server-side template injection — org.jeecgframework.boot:jeecg-boot-common <= 3.5.3 → no fix
- 2023-12-27 [CVE-2023-51084](https://erroneo.us/security/cve/CVE-2023-51084/index.md) hyavijava stack overflow vulnerability — com.github:hyavijava <= 6.0.07.1 → no fix
- 2023-12-21 [CVE-2023-51656](https://erroneo.us/security/cve/CVE-2023-51656/index.md) Apache IoTDB: Unsafe deserialize map in Sync Tool — org.apache.iotdb:iotdb-parent >= 0.13.0, < 1.2.2 → 1.2.2
- 2023-12-15 [CVE-2023-50723](https://erroneo.us/security/cve/CVE-2023-50723/index.md) Remote code execution/programming rights with configuration section from any user account — org.xwiki.platform:xwiki-platform-administration-ui >= 2.3, < 14.10.15 → 14.10.15; org.xwiki.platform:xwiki-platform-administration-ui >= 15.0-rc-1, < 15.5.2 → 15.5.2; org.xwiki.platform:xwiki-platform-administration-ui >= 15.6-rc-1, < 15.7-rc-1 → 15.7-rc-1
- 2023-12-15 [CVE-2023-49898](https://erroneo.us/security/cve/CVE-2023-49898/index.md) Apache StreamPark: Authenticated system users could trigger remote command execution — org.apache.streampark:streampark >= 2.0.0, < 2.1.2 → 2.1.2
- 2023-12-15 [CVE-2023-50722](https://erroneo.us/security/cve/CVE-2023-50722/index.md) XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass — org.xwiki.platform:xwiki-platform-administration-ui >= 2.3, < 14.10.15 → 14.10.15; org.xwiki.platform:xwiki-platform-administration-ui >= 15.0-rc-1, < 15.5.2 → 15.5.2; org.xwiki.platform:xwiki-platform-administration-ui >= 15.6-rc-1, < 15.7-rc-1 → 15.7-rc-1
- 2023-12-15 [CVE-2023-46279](https://erroneo.us/security/cve/CVE-2023-46279/index.md) Apache Dubbo: Bypass deny serialize list check in Apache Dubbo — org.apache.dubbo:dubbo = 3.1.5 → 3.1.6
- 2023-12-15 [CVE-2023-50721](https://erroneo.us/security/cve/CVE-2023-50721/index.md) Remote code execution from account through SearchAdmin — org.xwiki.platform:xwiki-platform-search-ui >= 4.5-rc-1, < 14.10.15 → 14.10.15; org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.2 → 15.5.2; org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.7-rc-1 → 15.7-rc-1
- 2023-12-15 [CVE-2023-29234](https://erroneo.us/security/cve/CVE-2023-29234/index.md) Bypass serialize checks in Apache Dubbo — org.apache.dubbo:dubbo >= 3.1.0, < 3.1.11 → 3.1.11; org.apache.dubbo:dubbo >= 3.2.0, < 3.2.5 → 3.2.5
- 2023-12-13 [CVE-2023-50422](https://erroneo.us/security/cve/CVE-2023-50422/index.md) Improper JWT Signature Validation in SAP Security Services Library — com.sap.cloud.security:java-security < 2.17.0 → 2.17.0; com.sap.cloud.security:java-security >= 3.0.0, < 3.3.0 → 3.3.0; com.sap.cloud.security:spring-security < 2.17.0 → 2.17.0
- 2023-12-07 [CVE-2023-50164](https://erroneo.us/security/cve/CVE-2023-50164/index.md) Apache Struts vulnerable to path traversal — org.apache.struts:struts2-core >= 6.0.0, < 6.3.0.2 → 6.3.0.2; org.apache.struts:struts2-core >= 2.0.0, < 2.5.33 → 2.5.33
- 2023-12-04 [CVE-2023-48967](https://erroneo.us/security/cve/CVE-2023-48967/index.md) Solon is vulnerable to Deserialization of Untrusted Data — org.noear:solon <= 2.6.0 → no fix
- 2023-12-04 [CVE-2023-48910](https://erroneo.us/security/cve/CVE-2023-48910/index.md) Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download — io.github.microcks:microcks < 1.17.1 → 1.17.1
- 2023-12-04 [CVE-2023-49093](https://erroneo.us/security/cve/CVE-2023-49093/index.md) HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL — org.htmlunit:htmlunit < 3.9.0 → 3.9.0
- 2023-12-01 [CVE-2023-49371](https://erroneo.us/security/cve/CVE-2023-49371/index.md) RuoYi vulnerable to SQL injection vulnerability — com.ruoyi:ruoyi <= 4.6 → no fix

Pages: https://erroneo.us/security/ecosystem/maven/index.md · https://erroneo.us/security/ecosystem/maven/2/index.md · https://erroneo.us/security/ecosystem/maven/3/index.md · https://erroneo.us/security/ecosystem/maven/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/maven/3/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt