deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rx6w-2w6h-r346
Package: com.github.psi-probe:psi-probe-core (MAVEN)
Severity: LOW (CVSS 4.3)
CWE: CWE-285: Improper Authorization, CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: <= 5.3.0
Patched in: unpatched

Summary: PSI Probe: Broken access control can lead to DoS 

Details:
A flaw has been found in psi-probe PSI Probe up to 5.3.0. The impacted element is the function handleRequestInternal of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/ExpireSessionsController.java of the component Session Handler. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-33hj-rcmx-86mv
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.3.0.Alpha1, < 2.3.21.Final
Patched in: 2.3.21.Final

Summary: Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names

Details:
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
GitHub Security Advisory: GHSA-33hj-rcmx-86mv
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: = 2.4.0.Alpha1
Patched in: 2.4.0.Beta1

Summary: Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names

Details:
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
GitHub Security Advisory: GHSA-33hj-rcmx-86mv
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.2.39.Final
Patched in: 2.2.39.Final

Summary: Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names

Details:
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
GitHub Security Advisory: GHSA-6h4f-pj3g-q8fq
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.3.0.Alpha1, < 2.3.21.Final
Patched in: 2.3.21.Final

Summary: Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

Details:
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
GitHub Security Advisory: GHSA-6h4f-pj3g-q8fq
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.2.39.Final
Patched in: 2.2.39.Final

Summary: Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

Details:
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
GitHub Security Advisory: GHSA-6h4f-pj3g-q8fq
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.0.Alpha1
Patched in: 2.4.0.Beta1

Summary: Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

Details:
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
GitHub Security Advisory: GHSA-wfhp-qgm8-5p5c
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.541.2
Patched in: 2.541.2

Summary: Jenkins has a build information disclosure vulnerability through Run Parameter 

Details:
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
GitHub Security Advisory: GHSA-wfhp-qgm8-5p5c
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.542, < 2.551
Patched in: 2.551

Summary: Jenkins has a build information disclosure vulnerability through Run Parameter 

Details:
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
GitHub Security Advisory: GHSA-85h6-5m3v-gx37
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: HIGH (CVSS 8.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.483, < 2.541.2
Patched in: 2.541.2

Summary: Jenkins has a stored XSS vulnerability in node offline cause description

Details:
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
GitHub Security Advisory: GHSA-85h6-5m3v-gx37
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: HIGH (CVSS 8.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.542, < 2.551
Patched in: 2.551

Summary: Jenkins has a stored XSS vulnerability in node offline cause description

Details:
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
GitHub Security Advisory: GHSA-87xj-ghmc-c3xq
Package: tech.powerjob:powerjob (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 5.1.2
Patched in: unpatched

Summary:  PowerJob has Missing Authorization in its /user/list file

Details:
A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
GitHub Security Advisory: GHSA-5476-xc4j-rqcv
Package: com.mchange:c3p0 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.12.0
Patched in: 0.12.0

Summary: c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Details:
### Impact

c3p0 is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`.

The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`.

Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility.

### Patches

The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization.

c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. Those parameters are documented [here](https://www.mchange.com/projects/c3p0/#configuring_security).

c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names.

### Workarounds

Users should upgrade to c3p0-0.12.0 or above. There is no supported workaround for earlier versions of c3p0.

### References

[c3p0, you little rascal &mdash; Hans-Martin Münch](https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal/)
[c3p0 documentation, security note](https://www.mchange.com/projects/c3p0/#security-note)
[c3p0 documentation, configuring security](https://www.mchange.com/projects/c3p0/#configuring_security)
GitHub Security Advisory: GHSA-m2cm-222f-qw44
Package: com.mchange:mchange-commons-java (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.4.0
Patched in: 0.4.0

Summary: mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Details:
### Impact
mchange-commons-java includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code.

Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened.

### Patches
Mirroring the JDK patch, mchange-commons-java's JNDI functionality is now gated by configuration parameters that default to restrictive values. Those parameters are documented [here](https://www.mchange.com/projects/c3p0/#configuring_security).

### Workarounds
No. Users should upgrade to mchange-commons-java >= 0.4.0. Earlier versions should be avoided on application CLASSPATHs.

### References

[c3p0, you little rascal &mdash; Hans-Martin Münch](https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal/)
[c3p0 documentation, security note](https://www.mchange.com/projects/c3p0/#security-note)
[c3p0 documentation, configuring security](https://www.mchange.com/projects/c3p0/#configuring_security)
GitHub Security Advisory: GHSA-429q-mrc4-38fr
Package: org.apache.camel:camel-leveldb (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 4.15.0, < 4.18.0
Patched in: 4.18.0

Summary: Apache Camel Deserializes Untrusted Data in its LevelDB Component

Details:
Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.

The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5
GitHub Security Advisory: GHSA-429q-mrc4-38fr
Package: org.apache.camel:camel-leveldb (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 4.11.0, < 4.14.5
Patched in: 4.14.5

Summary: Apache Camel Deserializes Untrusted Data in its LevelDB Component

Details:
Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.

The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5
GitHub Security Advisory: GHSA-429q-mrc4-38fr
Package: org.apache.camel:camel-leveldb (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 3.0.0, < 4.10.9
Patched in: 4.10.9

Summary: Apache Camel Deserializes Untrusted Data in its LevelDB Component

Details:
Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.

The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5
GitHub Security Advisory: GHSA-c3f3-cc42-xr9v
Package: org.apache.camel:camel-keycloak (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 4.15.0, < 4.18.0
Patched in: 4.18.0

Summary: Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

Details:
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. 

The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.
This issue affects Apache Camel: from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue.
GitHub Security Advisory: GHSA-vx9q-rhv9-3jvg
Package: io.airlift:aircompressor (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-125: Out-of-bounds Read, CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: < 2.0.3
Patched in: 2.0.3

Summary: aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

Details:
### Summary
Incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.

### Details
With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to [GHSA-cmp6-m4wj-q63q](https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q).

### Impact
Applications using aircompressor as described above may leak sensitive information to external unauthorized attackers.

### Mitigation

The vulnerability is fixed in release 3.4 and 2.0.3. However, it can be mitigated by either:
* Avoiding reuse of the decompression buffer across calls
* Clearing the decompression buffer before a call to decompress data
GitHub Security Advisory: GHSA-hf23-9pf7-388p
Package: com.thoughtworks.xstream:xstream (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: = 1.4.10
Patched in: 1.4.11

Summary: Deserialization of Untrusted Data and Code Injection in xstream

Details:
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
GitHub Security Advisory: GHSA-p6jf-79j3-33f3
Package: org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 9.32.167
Patched in: 9.32.167

Summary: carbon-apimgt does not properly restrict uploaded files

Details:
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. 

 By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
GitHub Security Advisory: GHSA-rp46-r563-jrc7
Package: org.apache.avro:avro-compiler (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.11.5
Patched in: 1.11.5

Summary: Apache Avro Java SDK is Vulnerable to Code Injection

Details:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
GitHub Security Advisory: GHSA-rp46-r563-jrc7
Package: org.apache.avro:avro-compiler (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: = 1.12.0
Patched in: 1.12.1

Summary: Apache Avro Java SDK is Vulnerable to Code Injection

Details:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
GitHub Security Advisory: GHSA-fjf4-6f34-w64q
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.8)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 26.5.3
Patched in: unpatched

Summary: Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

Details:
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.
GitHub Security Advisory: GHSA-fwxx-wv44-7qfg
Package: org.springframework.cloud:spring-cloud-gateway-server (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: <= 3.1.10
Patched in: unpatched

Summary: Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

Details:
The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers.

An application should be considered vulnerable when all the following are true:

  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
  *  An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes.
  *  An untrusted third party could create a route that uses SpEL to access environment variables or system properties if:  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte.
  *  The actuator endpoints are available to attackers.
  *  The actuator endpoints are unsecured.