Threats tagged 'maven'

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in the browser of any user (including administrators) who views the blog post. This leads to potential session hijacking or privilege escalation. The vulnerability has been patched in the blog application version 9.15.7 by adding missing escaping. No known workarounds are available.

A vulnerability in the async JSON parser of jackson-core allows bypassing the maxNumberLength constraint, enabling parsing of arbitrarily long numbers. This leads to excessive memory allocation and potential CPU exhaustion, causing a Denial of Service (DoS). The synchronous parser enforces the limit correctly, but the async parser fails to validate number length due to skipped checks in its code path. This inconsistency creates a resource exhaustion risk when processing large numeric JSON values asynchronously.

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Apache Tomcat and Tomcat Native contain an improper input validation vulnerability in their OCSP response handling. This flaw allows bypassing certificate revocation checks because Tomcat Native and Tomcat's FFM port did not complete verification or freshness checks on OCSP responses. The vulnerability affects multiple versions of Apache Tomcat Native and Apache Tomcat. Fixed versions have been released to address this issue.

A vulnerability in Keycloak Quarkus Server allows sensitive HTTP headers such as Authorization and Cookie to be logged in cleartext when verbose user-supplied logging patterns are used. An attacker with access to these logs could extract credentials like bearer tokens and session cookies, potentially leading to user impersonation and account compromise. Patches addressing this issue are available in Keycloak version 26.5.6 and later.

CVE-2024-5986 is a critical vulnerability in h2oai/h2o-3 version 3.46.0.1 and earlier that allows remote attackers to write arbitrary data to any file on the server. This is done by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which can then be exported via the /3/Frames/framename/export endpoint. The vulnerability can lead to remote code execution and full system compromise by overwriting critical files such as private SSH keys or scripts.

An improper verification of cryptographic signature vulnerability exists in the quick-media project, specifically in the batik-codec-fix module affecting PNG codec functionality. This flaw impacts all versions up to and including 3.0.0. A patch addressing the issue has been made available. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Fastjson before 1.2.48 mishandles autoType because, when an `@type` key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

An XML External Entity (XXE) vulnerability in multiple WSO2 products arises from improper XML parser configuration that allows external entity resolution. This flaw enables remote, unauthenticated attackers with high privileges to read sensitive server files or cause denial-of-service (DoS) conditions. The vulnerability is identified as CVE-2025-10713 with a medium severity rating and a CVSS score of 6.5.

Liferay Portal versions 7.4.0 through 7.4.3.111 and certain older unsupported versions, as well as specific Liferay DXP releases, contain a cross-site scripting (XSS) vulnerability in the Blogs widget. This flaw allows remote attackers to inject arbitrary web scripts or HTML via a crafted <iframe> in a blog entry's content. The vulnerability arises because the Blogs widget does not add the sandbox attribute to <iframe> elements, enabling scripts in the iframe to access the parent page. A fix is available in version 7.4.3.112-ga112.

Liferay Portal versions 7.4.0 through 7.4.3.109 and certain older unsupported versions, as well as specific Liferay DXP versions, are vulnerable to DNS rebinding attacks. This vulnerability allows remote attackers to redirect users to arbitrary external URLs by exploiting the default redirect URL security setting. The issue can be mitigated by changing the redirect URL security from IP-based to domain-based validation. A fix is available in version 7.4.3.110.

Liferay Portal versions 7.4.0 through 7.4.3.119 and certain Liferay DXP versions are vulnerable to a password enumeration flaw. This vulnerability allows remote attackers to determine valid user passwords via brute force attacks, even when account lockout mechanisms are enabled. The issue affects multiple versions including 7.4 GA through update 92 and specific quarterly releases of Liferay DXP. A fix is available in version 7.4.3.120.

The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier lacks a permission check on an HTTP endpoint, allowing attackers with Overall/Read permission to misuse credentials stored in Jenkins. This endpoint also does not require POST requests, leading to a cross-site request forgery (CSRF) vulnerability. No fix is currently available for this issue.

The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier lacks a permission check in a form validation method. This flaw allows attackers with Overall/Read permission to enumerate credential IDs stored in Jenkins. These credential IDs could potentially be leveraged in conjunction with other vulnerabilities to capture credentials. No fix is currently available for this issue.

The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier contains a vulnerability where an HTTP endpoint does not perform proper permission checks. This flaw allows attackers with Overall/Read permission to connect to attacker-controlled URLs using credentials IDs obtained by other means, potentially exposing stored Jenkins credentials. The endpoint also lacks enforcement of POST requests, leading to a cross-site request forgery (CSRF) vulnerability. No fix is currently available for this issue.

The Jenkins Curseforge Publisher Plugin version 1.0 and earlier stores API keys unencrypted in job configuration files on the Jenkins controller. These keys are visible to users with Item/Extended Read permission or those with file system access to the Jenkins controller. Additionally, the plugin's job configuration form does not mask the API keys, increasing the risk of accidental exposure. No fix is currently available for this vulnerability.

The Jenkins Curseforge Publisher Plugin version 1.0 and earlier stores API keys unencrypted in job configuration files on the Jenkins controller. These keys are accessible to users with Item/Extended Read permissions or those with file system access to the Jenkins controller. The job configuration form also does not mask these keys, increasing the risk of exposure. No fix is currently available for this vulnerability.

The Jenkins ByteGuard Build Actions Plugin version 1.0 and earlier stores API tokens unencrypted in job configuration files on the Jenkins controller. These tokens are visible to users with Item/Extended Read permission or those with file system access to the Jenkins controller. The plugin's job configuration form also does not mask these credentials, increasing the risk of token exposure. No fix is currently available for this vulnerability.

The Jenkins ByteGuard Build Actions Plugin version 1.0 and earlier stores API tokens unencrypted in job configuration files on the Jenkins controller. These tokens are accessible to users with Item/Extended Read permissions or those with file system access to the Jenkins controller. Additionally, the plugin's job configuration form does not mask these credentials, increasing the risk of token exposure. No fix is currently available for this vulnerability.