Maven - OSV

GHSA-vjfw-cpmh-xwv3

Maven/com.linecorp.centraldogma:centraldogma-server-mirror-git

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror) 3 days ago

Fix available
Severity - 8.8 (High)

GHSA-2j95-gqxf-v3vg

Maven/com.linecorp.centraldogma:centraldogma-server

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover 3 days ago

Fix available
Severity - 9.4 (Critical)

GHSA-98q5-5qh2-7w75

Maven/com.linecorp.centraldogma:centraldogma-server-auth-shiro

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion 3 days ago

Fix available
Severity - 6.9 (Medium)

GHSA-5hx7-j24v-rffj

Maven/org.geonetwork-opensource:gn-web-app

GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool 5 days ago

Fix available
Severity - 7.7 (High)

GHSA-c4c3-7fpv-j4q5

Maven/io.netty:netty-handler

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext 6 days ago

Fix available
Severity - 9.1 (Critical)

GHSA-fccg-mwvh-qqg4

Maven/io.netty:netty-handler

Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing 6 days ago

Fix available
Severity - 6.9 (Medium)

GHSA-g29j-rwfv-h99w

Maven/com.github.jknack:handlebars-springmvc

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass 02 Sep

Fix available
Severity - 7.5 (High)

GHSA-c857-9x2m-cvh2

Maven/org.mariadb:r2dbc-mariadb

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport) 28 Aug

Fix available
Severity - 5.9 (Medium)

GHSA-5rqc-86vf-g8r2

Maven/org.mariadb:r2dbc-mariadb

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output 28 Aug

Fix available
Severity - 5.9 (Medium)

GHSA-xvr9-35cr-46v9

Maven/org.mariadb.jdbc:mariadb-java-client

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context 28 Aug

Fix available
Severity - 5.9 (Medium)

GHSA-qxvw-fvwx-5cp7

Maven/org.mariadb.jdbc:mariadb-java-client

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials 28 Aug

Fix available
Severity - 5.9 (Medium)

GHSA-g9jj-cgmh-9f38

Maven/org.mariadb.jdbc:mariadb-java-client

MariaDB has cleartext password disclosure to a MITM on the initial-handshake 28 Aug

Fix available
Severity - 5.9 (Medium)

GHSA-5v29-34h8-v68r

Maven/org.mapfish.print:print-lib
Maven/org.mapfish.print:print-servlet
Maven/org.mapfish:print.print-servlet

MapFish Print has XXE that allows reading arbitrary files of certain types 28 Aug

Fix available
Severity - 8.6 (High)

GHSA-j769-9gv9-65gr

Maven/org.graylog2:graylog2-server

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens 28 Aug

Fix available
Severity - 5.3 (Medium)

GHSA-gqr6-r77p-c2pj

Maven/org.graylog2:graylog2-server

Fortigate syslog message parser can be exploited to modify or delete fields from the original message 28 Aug

Fix available
Severity - 7.5 (High)

GHSA-jqvf-j3ww-r8c7

Maven/com.powsybl:powsybl-computation-local

PowSyBl Core has Command Injection in LocalCommandExecutor-s 28 Aug

Fix available
Severity - 7.1 (High)

Vulnerabilities