deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-66x6-8jgv-qpfh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.13.u14, <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

Details:
A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.
GitHub Security Advisory: GHSA-66x6-8jgv-qpfh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.Q1.1, <= 2024.Q1.12
Patched in: 2024.Q1.13

Summary: Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

Details:
A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.
GitHub Security Advisory: GHSA-66x6-8jgv-qpfh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.Q2.0, <= 2024.Q2.13
Patched in: 2024.Q3.0

Summary: Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

Details:
A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.
GitHub Security Advisory: GHSA-66x6-8jgv-qpfh
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.45, < 7.4.3.129
Patched in: 7.4.3.129

Summary: Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

Details:
A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.
GitHub Security Advisory: GHSA-3vcp-r62v-xpvg
Package: org.apache.dolphinscheduler:dolphinscheduler (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 3.2.2
Patched in: 3.2.2

Summary: Apache DolphinScheduler vulnerable to Alert Script Attack

Details:
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script.


This issue affects Apache DolphinScheduler: before 3.2.2.

Users are recommended to upgrade to version 3.3.1, which fixes the issue.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay:com.liferay.portal.workflow.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: < 4.0.94
Patched in: 4.0.94

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 2025.Q2.0, <= 2025.Q2.9
Patched in: 2025.Q2.10

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 2025.Q1.0, <= 2025.Q1.16
Patched in: 2025.Q1.17

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 2024.Q4.0, <= 2024.Q4.7
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 2024.Q3.0, <= 2024.Q3.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 2024.Q2.0, <= 2024.Q2.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 2024.Q1.1, <= 2024.Q1.19
Patched in: 2024.Q1.20

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 7.4, <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-rcc7-jx7p-hrv4
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 7.4.0, <= 7.4.3.132
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

Details:
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
GitHub Security Advisory: GHSA-9vwq-j6gq-w9xh
Package: com.liferay:com.liferay.portal.security.sso.openid.connect.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 6.0.4, < 7.0.48
Patched in: 7.0.48

Summary: Liferay Portal exposes 500 status when attempting login with a deleted client secret

Details:
Liferay Portal  7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.
GitHub Security Advisory: GHSA-cpg4-qcj8-42gp
Package: com.liferay:com.liferay.portal.workflow.kaleo.forms.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.3, < 5.0.107
Patched in: 5.0.107

Summary: Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

Details:
A Stored cross-site scripting vulnerability in the Liferay Portal  7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.
GitHub Security Advisory: GHSA-477q-x55m-j38g
Package: com.liferay:com.liferay.object.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 1.0.208
Patched in: 1.0.208

Summary: Liferay Portal is vulnerable to SSRF through custom object attachment fields

Details:
A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal  7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.
GitHub Security Advisory: GHSA-qgj5-4qvg-2f8c
Package: com.liferay:com.liferay.frontend.taglib.clay (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 15.2.1
Patched in: 15.2.1

Summary: Liferay Portal is vulnerable to XSS attack through its Style Book theme

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.17 allows a remote authenticated user to inject JavaScript code via Style Book theme name. This malicious payload is then reflected and executed within the user's browser.
GitHub Security Advisory: GHSA-cxvc-g8f2-4gmm
Package: org.apache.jackrabbit:jackrabbit-jcr-commons (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 1.0.0, < 2.22.2
Patched in: 2.22.2

Summary: Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data

Details:
There is a serialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
GitHub Security Advisory: GHSA-cxvc-g8f2-4gmm
Package: org.apache.jackrabbit:jackrabbit-core (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 1.0.0, < 2.22.2
Patched in: 2.22.2

Summary: Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data

Details:
There is a serialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
GitHub Security Advisory: GHSA-gwj6-xpfg-pxwr
Package: org.xwiki.contrib.blog:application-blog-ui (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), CWE-250: Execution with Unnecessary Privileges
Vulnerable versions: < 9.14
Patched in: 9.14

Summary: XWiki Blog Application: Privilege Escalation (PR) from account through blog content

Details:
### Impact
The blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. To exploit, it is sufficient to add an object of type `Blog.BlogPostClass` to any page and to add some script macro with the exploit code to the "Content" field of that object.

### Patches
The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author.

### Workarounds
We're not aware of any workarounds.

### Resources
* https://jira.xwiki.org/browse/BLOG-191
* https://github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4
GitHub Security Advisory: GHSA-q92v-3f4w-5xg8
Package: org.jenkins-ci.plugins:applitools-eyes (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: <= 1.16.5
Patched in: unpatched

Summary: Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated users

Details:
Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_3 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.13.0-M1, < 3.13.0-M7
Patched in: 3.13.0-M7

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.13 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.13.0-M1, < 3.13.0-M7
Patched in: 3.13.0-M7

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.12 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.13.0-M1, < 3.13.0-M7
Patched in: 3.13.0-M7

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-q35w-85pq-rv3x
Package: fish.payara.distributions:payara (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: <= 4.1.2.181
Patched in: unpatched

Summary: Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF

Details:
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.