deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6pgj-w687-9c8c
Package: com.liferay:com.liferay.portal.cluster.multiple (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 5.0.35
Patched in: 5.0.35

Summary: Liferay Portal fails to verify messages from the cluster network is trusted

Details:
Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions that will treat it as trusted data via unauthenticated cluster messages.
GitHub Security Advisory: GHSA-54wc-49qj-5ghj
Package: net.mingsoft:ms-mcms (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.5.0, < 6.0.2
Patched in: 6.0.2

Summary: MCMS vulnerable SQL injection via the content_title parameter

Details:
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.
GitHub Security Advisory: GHSA-825g-mm5v-ggq4
Package: org.apache.syncope.core:syncope-core-spring (MAVEN)
Severity: HIGH (CVSS 7.2)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: >= 4.0.0-M0, < 4.0.2
Patched in: 4.0.2

Summary: Apache Syncope allows malicious administrators to inject Groovy code

Details:
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload.
Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.
Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
GitHub Security Advisory: GHSA-825g-mm5v-ggq4
Package: org.apache.syncope.core:syncope-core-spring (MAVEN)
Severity: HIGH (CVSS 7.2)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 3.0.14
Patched in: 3.0.14

Summary: Apache Syncope allows malicious administrators to inject Groovy code

Details:
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload.
Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.
Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
GitHub Security Advisory: GHSA-gjp8-99fv-cgcw
Package: org.apache.geode:geode-web (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 1.10.0, < 1.15.2
Patched in: 1.15.2

Summary: Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Details:
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user.


This issue affects Apache Geode: versions 1.10 through 1.15.1

Users are recommended to upgrade to version 1.15.2, which fixes the issue.
GitHub Security Advisory: GHSA-rmjr-87wv-gf87
Package: org.zwobble.mammoth:mammoth (MAVEN)
Severity: MODERATE (CVSS 9.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.11.0
Patched in: 1.11.0

Summary: Mammoth is vulnerable to Directory Traversal

Details:
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.
GitHub Security Advisory: GHSA-27gc-wj6x-9w55
Package: org.keycloak:keycloak-admin-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 26.3.0, < 26.3.4
Patched in: 26.3.4

Summary: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
Keycloak’s account console accepts arbitrary text in the `error_description` query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-27gc-wj6x-9w55
Package: org.keycloak:keycloak-admin-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 26.2.9
Patched in: 26.2.9

Summary: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
Keycloak’s account console accepts arbitrary text in the `error_description` query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-27gc-wj6x-9w55
Package: org.keycloak:keycloak-account-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 26.3.0, < 26.3.4
Patched in: 26.3.4

Summary: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
Keycloak’s account console accepts arbitrary text in the `error_description` query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-27gc-wj6x-9w55
Package: org.keycloak:keycloak-account-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 26.2.9
Patched in: 26.2.9

Summary: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
Keycloak’s account console accepts arbitrary text in the `error_description` query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-7fch-4f2f-jcgm
Package: org.springframework:spring-websocket (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 5.3.39
Patched in: unpatched

Summary: Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

Details:
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

### Affected Spring Products and Versions
Spring Framework:

  *  6.2.0 - 6.2.11
  *  6.1.0 - 6.1.23
  *  6.0.x - 6.0.29
  *  5.3.0 - 5.3.45
  *  Older, unsupported versions are also affected.


### Mitigation
Users of affected versions should upgrade to the corresponding fixed version.

### Affected version(s)
Fix version | Availability
-|-
6.2.x | 6.2.12 OSS
6.1.x | 6.1.24 Commercial https://enterprise.spring.io/
6.0.x | N/A Out of support https://spring.io/projects/spring-framework#support
5.3.x | 5.3.46 Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
GitHub Security Advisory: GHSA-7fch-4f2f-jcgm
Package: org.springframework:spring-websocket (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 6.0.0, <= 6.0.23
Patched in: unpatched

Summary: Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

Details:
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

### Affected Spring Products and Versions
Spring Framework:

  *  6.2.0 - 6.2.11
  *  6.1.0 - 6.1.23
  *  6.0.x - 6.0.29
  *  5.3.0 - 5.3.45
  *  Older, unsupported versions are also affected.


### Mitigation
Users of affected versions should upgrade to the corresponding fixed version.

### Affected version(s)
Fix version | Availability
-|-
6.2.x | 6.2.12 OSS
6.1.x | 6.1.24 Commercial https://enterprise.spring.io/
6.0.x | N/A Out of support https://spring.io/projects/spring-framework#support
5.3.x | 5.3.46 Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
GitHub Security Advisory: GHSA-7fch-4f2f-jcgm
Package: org.springframework:spring-websocket (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 6.1.0, <= 6.1.21
Patched in: unpatched

Summary: Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

Details:
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

### Affected Spring Products and Versions
Spring Framework:

  *  6.2.0 - 6.2.11
  *  6.1.0 - 6.1.23
  *  6.0.x - 6.0.29
  *  5.3.0 - 5.3.45
  *  Older, unsupported versions are also affected.


### Mitigation
Users of affected versions should upgrade to the corresponding fixed version.

### Affected version(s)
Fix version | Availability
-|-
6.2.x | 6.2.12 OSS
6.1.x | 6.1.24 Commercial https://enterprise.spring.io/
6.0.x | N/A Out of support https://spring.io/projects/spring-framework#support
5.3.x | 5.3.46 Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
GitHub Security Advisory: GHSA-7fch-4f2f-jcgm
Package: org.springframework:spring-websocket (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 6.2.0, < 6.2.12
Patched in: 6.2.12

Summary: Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

Details:
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

### Affected Spring Products and Versions
Spring Framework:

  *  6.2.0 - 6.2.11
  *  6.1.0 - 6.1.23
  *  6.0.x - 6.0.29
  *  5.3.0 - 5.3.45
  *  Older, unsupported versions are also affected.


### Mitigation
Users of affected versions should upgrade to the corresponding fixed version.

### Affected version(s)
Fix version | Availability
-|-
6.2.x | 6.2.12 OSS
6.1.x | 6.1.24 Commercial https://enterprise.spring.io/
6.0.x | N/A Out of support https://spring.io/projects/spring-framework#support
5.3.x | 5.3.46 Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
GitHub Security Advisory: GHSA-4cx2-fc23-5wg6
Package: org.bouncycastle:bcpkix-jdk18on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.44, < 1.79
Patched in: 1.79

Summary: Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files  https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java ,  https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
GitHub Security Advisory: GHSA-4cx2-fc23-5wg6
Package: org.bouncycastle:bcpkix-jdk15to18 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.44, < 1.79
Patched in: 1.79

Summary: Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files  https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java ,  https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
GitHub Security Advisory: GHSA-4cx2-fc23-5wg6
Package: org.bouncycastle:bcpkix-jdk15on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.44, < 1.79
Patched in: 1.79

Summary: Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files  https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java ,  https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
GitHub Security Advisory: GHSA-xmcw-mv9p-7pq2
Package: org.keycloak:keycloak-admin-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 26.3.0, < 26.3.4
Patched in: 26.3.4

Summary: Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-xmcw-mv9p-7pq2
Package: org.keycloak:keycloak-admin-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 26.2.9
Patched in: 26.2.9

Summary: Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-xmcw-mv9p-7pq2
Package: org.keycloak:keycloak-account-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 26.3.0, < 26.3.4
Patched in: 26.3.4

Summary: Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-xmcw-mv9p-7pq2
Package: org.keycloak:keycloak-account-ui (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 26.2.9
Patched in: 26.2.9

Summary: Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. This creates a phishing vector, potentially tricking users into contacting malicious actors.
GitHub Security Advisory: GHSA-3xgr-h5hq-7299
Package: org.opensearch.dataprepper.plugins:geoip-processor (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 2.7.0, < 2.12.2
Patched in: 2.12.2

Summary: GeoIP processor disables SSL certificate validation when downloading databases

Details:
### Impact

The GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks.

The GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The `initiateSSL()` method incorrectly implemented an approach for trusting all certificates. Specifically it:

* Accepted all SSL certificates without validation
* Disabled server certificate verification
* Disabled client certificate verification
* Disabled hostname verification

This configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing.

### Patches

Data Prepper 2.12.2 contains a fix for this issue.

### Workarounds

If upgrading is not immediately possible:

* Use local GeoIP database files instead of downloading from HTTP URLs
* Ensure database downloads occur only over trusted networks