deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-qmgx-j96g-4428
Package: org.apache.cxf:cxf-rt-databinding-aegis (MAVEN)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 3.5.8
Patched in: 3.5.8

Summary: SSRF vulnerability using the Aegis DataBinding in Apache CXF

Details:
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
GitHub Security Advisory: GHSA-444m-px7r-qpvv
Package: com.foxinmy:weixin4j-base (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1325: Improperly Controlled Sequential Memory Allocation
Vulnerable versions: <= 1.10.2
Patched in: unpatched

Summary: weixin4j has Improperly Controlled Sequential Memory Allocation 

Details:
Improperly Controlled Sequential Memory Allocation vulnerability in foxinmy weixin4j (weixin4j-base/src/main/java/com/foxinmy/weixin4j/util modules). This vulnerability is associated with program files CharArrayBuffer.Java, ClassUtil.Java.

This issue affects all versions of weixin4j. A path is available:  [d1c8258](https://github.com/foxinmy/weixin4j/commit/4b7ad14df6567064b468b4c9cb7a8bfeff48c8bd)
GitHub Security Advisory: GHSA-23f4-hfmq-94mj
Package: com.github.liuyueyi.media:batik-codec-fix (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), CWE-190: Integer Overflow or Wraparound
Vulnerable versions: <= 3.0.0
Patched in: unpatched

Summary: Quick-Media Batik Codec FIX Package has Buffer Overflow Vulnerability in PNG Codec

Details:
Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.

This issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)
GitHub Security Advisory: GHSA-8623-9fwr-4cxv
Package: com.github.liuyueyi.media:batik-codec-fix (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 3.0.0
Patched in: unpatched

Summary: Quick-Media Batik Codec FIX package has Code Injection vulnerability

Details:
Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.

This issue affects all quick-media versions. A patch is available: [e52fcee](https://github.com/liuyueyi/quick-media/commit/e52fceee32775a6be8ed1e394fbe94f4f8db036a)
GitHub Security Advisory: GHSA-hcx3-3q5c-r5v6
Package: com.github.briandilley.jsonrpc4j:jsonrpc4j (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 1.7.0
Patched in: 1.7.0

Summary: jsonrpc4j has Infinite Loop in RPC Stream Writer 

Details:
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java.

This issue affects jsonrpc4j: through 1.6.0.
GitHub Security Advisory: GHSA-63v5-26vq-m4vm
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.1)
CWE: CWE-112: Missing XML Validation, CWE-347: Improper Verification of Cryptographic Signature, CWE-613: Insufficient Session Expiration
Vulnerable versions: <= 26.5.2
Patched in: unpatched

Summary: Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

Details:
A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.
GitHub Security Advisory: GHSA-frpp-8pwq-hjrx
Package: org.hibernate.reactive:hibernate-reactive-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-772: Missing Release of Resource after Effective Lifetime
Vulnerable versions: < 4.2.1
Patched in: 4.2.1

Summary: Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion

Details:
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
GitHub Security Advisory: GHSA-77p9-w6pj-rmvg
Package: org.apache.continuum:continuum (MAVEN)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 1.4.2
Patched in: unpatched

Summary: Apache Continuum vulnerable to Command Injection through Installations REST API

Details:
***UNSUPPORTED WHEN ASSIGNED*** 

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.

This issue affects Apache Continuum: all versions.

Attackers with access to the Installations REST API can use this to invoke arbitrary commands on the server.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
GitHub Security Advisory: GHSA-jmw5-58c7-587h
Package: org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.12.0
Patched in: 2.12.0

Summary: Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector

Details:
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.

The Decanter Log Socket Collector exposes port 4560 without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. The Log Socket Collector is vulnerable to deserialization of untrusted data, eventually causing DoS.

NB: Decanter Log Socket Collector is not installed by default. Users who have not installed the Decanter Log Socket are not impacted by this issue.

This issue affects Apache Karaf Decanter before 2.12.0.

Users are recommended to upgrade to version 2.12.0, which fixes the issue.
GitHub Security Advisory: GHSA-92cc-952p-v8rh
Package: org.apache.hadoop:hadoop-hdfs-native-client (MAVEN)
Severity: HIGH (CVSS 7.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: >= 3.2.0, < 3.4.2
Patched in: 3.4.2

Summary: Apache Hadoop HDFS Native Client has Out-of-bounds Write Vulnerability 

Details:
Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client.

This issue affects Apache Hadoop: from 3.2.0 before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.
GitHub Security Advisory: GHSA-rqfh-9r24-8c9r
Package: org.assertj:assertj-core (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 1.4.0, <= 3.27.6
Patched in: 3.27.7

Summary: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

Details:
An XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values.

An application is vulnerable only when it uses untrusted XML input with one of the following methods:

- `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert`
- `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`

### Impact

If untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:

- **Read arbitrary local files** via `file://` URIs (e.g., `/etc/passwd`, application configuration files)
- **Perform Server-Side Request Forgery (SSRF)** via HTTP/HTTPS URIs
- **Cause Denial of Service** via "Billion Laughs" entity expansion attacks

### Mitigation

`isXmlEqualTo(CharSequence)` has been deprecated in favor of [XMLUnit](https://www.xmlunit.org/) in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:

1. Replace `isXmlEqualTo(CharSequence)` with XMLUnit, or
2. Upgrade to version 3.27.7, or
3. Avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input.

`XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

### References

- [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)
- [OWASP XXE Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)
GitHub Security Advisory: GHSA-wvqx-m5px-6cmp
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 17.5.0-rc-1, < 17.8.0-rc-1
Patched in: 17.8.0-rc-1

Summary: XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Details:
### Impact
A reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation.

### Patches
This vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71) can be applied manually, only a single line in `templates/logging_macros.vm` needs to be changed, no restart is required.

### References
* https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf
* https://jira.xwiki.org/browse/XWIKI-23462

### Attribution

We thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-wvqx-m5px-6cmp
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.5
Patched in: 17.4.5

Summary: XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Details:
### Impact
A reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation.

### Patches
This vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71) can be applied manually, only a single line in `templates/logging_macros.vm` needs to be changed, no restart is required.

### References
* https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf
* https://jira.xwiki.org/browse/XWIKI-23462

### Attribution

We thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-wvqx-m5px-6cmp
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 7.0-milestone-2, < 16.10.12
Patched in: 16.10.12

Summary: XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Details:
### Impact
A reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation.

### Patches
This vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71) can be applied manually, only a single line in `templates/logging_macros.vm` needs to be changed, no restart is required.

### References
* https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf
* https://jira.xwiki.org/browse/XWIKI-23462

### Attribution

We thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-vqxh-445g-37fc
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: = 6.4.4
Patched in: 6.4.5

Summary: Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide

Details:
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
GitHub Security Advisory: GHSA-vqxh-445g-37fc
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: = 6.3.8
Patched in: 6.3.9

Summary: Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide

Details:
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
GitHub Security Advisory: GHSA-qqpg-mvqg-649v
Package: ch.qos.logback:logback-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.5.25
Patched in: 1.5.25

Summary: Logback allows an attacker to instantiate classes already present on the class path

Details:
ACE vulnerability in configuration file processing  by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.

The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must  have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
GitHub Security Advisory: GHSA-vc2w-4v3p-2mqw
Package: org.apache.solr:solr-core (MAVEN)
Severity: HIGH (CVSS 7.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 8.6.0, < 9.10.1
Patched in: 9.10.1

Summary: Apache Solr: Insufficient file-access checking in standalone core-creation requests

Details:
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's  "allowPaths" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .  These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.  On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes. 

Solr deployments are subject to this vulnerability if they meet the following criteria:
  *  Solr is running in its "standalone" mode.
  *  Solr's "allowPath" setting is being used to restrict file access to certain directories.
  *  Solr's "create core" API is exposed and accessible to untrusted users.  This can happen if Solr's  RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html  is disabled, or if it is enabled but the "core-admin-edit" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.

Users can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.  Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.
GitHub Security Advisory: GHSA-qr3p-2xj2-q7hq
Package: org.apache.solr:solr-core (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 5.3.0, < 9.10.1
Patched in: 9.10.1

Summary: Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

Details:
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components.  Only deployments that meet all of the following criteria are impacted by this vulnerability:

  *  Use of Solr's "RuleBasedAuthorizationPlugin"
  *  A RuleBasedAuthorizationPlugin config (see security.json) that specifies multiple "roles"
  *  A RuleBasedAuthorizationPlugin permission list (see security.json) that uses one or more of the following pre-defined permission rules: "config-read", "config-edit", "schema-read", "metrics-read", or "security-read".
  *  A RuleBasedAuthorizationPlugin permission list that doesn't define the "all" pre-defined permission
  *  A networking setup that allows clients to make unfiltered network requests to Solr. (i.e. user-submitted HTTP/HTTPS requests reach Solr as-is, unmodified or restricted by any intervening proxy or gateway)

Users can mitigate this vulnerability by ensuring that their RuleBasedAuthorizationPlugin configuration specifies the "all" pre-defined permission and associates the permission with an "admin" or other privileged role.  Users can also upgrade to a Solr version outside of the impacted range, such as the recently released Solr 9.10.1.
GitHub Security Advisory: GHSA-594w-2fwp-jwrc
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 2.7)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 26.2.5
Patched in: unpatched

Summary: Keycloak Admin REST API exposes backend schema and rules

Details:
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
GitHub Security Advisory: GHSA-m2w5-7xhv-w6fh
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.1)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 26.2.5
Patched in: unpatched

Summary: Keycloak does not validate and update refresh token usage atomically

Details:
A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.
GitHub Security Advisory: GHSA-7vw6-5q2f-7w5r
Package: org.keycloak:keycloak-adapter-core (MAVEN)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 25.0.3
Patched in: unpatched

Summary:  Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)

Details:
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a client to specify an arbitrary jwks_uri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the Keycloak server into making HTTP requests to internal or restricted network resources. As a result, attackers can probe internal services and cloud metadata endpoints, creating an information disclosure and reconnaissance risk.
GitHub Security Advisory: GHSA-7jc7-g598-2p64
Package: fr.opensagres.xdocreport:fr.opensagres.xdocreport.document (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 0.9.2, < 2.0.4
Patched in: 2.0.4

Summary: XDocReport affected by an XML External Entity (XXE) vulnerability

Details:
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
GitHub Security Advisory: GHSA-j382-5jj3-vw4j
Package: io.undertow:undertow-core (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.0.Alpha1
Patched in: unpatched

Summary: Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

Details:
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.