RHEL 6 / 7 : rh-maven33-groovy (RHSA-2017:2596)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2596 advisory. Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python,...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Script Console process. An attacker can execute arbitrary Groovy scripts by enticing a user to visit a crafted URL or by leveraging a cross-site scripting vulnerability. Remediation Upgrade...

CVE-2024-8980

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently...

CVE-2024-8980

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently...

CVE-2024-8980

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently...

CVE-2024-8980

CVE-2024-8980 is a CSRF flaw in the Script Console of Liferay Portal and Liferay DXP. Affected products/versions include Liferay Portal 7.0.0–7.4.3.101 and Liferay DXP 2023.Q3.1–2023.Q3.4, plus various 7.x release updates (e.g., 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through f...

CVE-2024-8980

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently...

CVE-2024-8980: Cross-Site Request Forgery (CSRF)

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently...

PT-2024-39349 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 6.2 GA through fix pack 173 Liferay Portal versions 7.0 GA through fix pack 102 Liferay Portal versions 7.0.0 through 7.4.3.101 Liferay DXP versions 7.1 GA through fix pack 28 Liferay DXP versions 7.2 GA through fix pa...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

RHSA-2017:2486 Red Hat Security Advisory: groovy security update

Bulletin has no description...

CVE-2024-45507 Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue...

Apache OFBiz Incorrect Authorization Vulnerability

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker...

VulnCheck KEV: CVE-2024-38856

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

com.cloudbees:groovy-cps-dgm-builder (>=3691.v28b_14c465a_b_b, <=3837.v305192405b_c0), org.jenkins-ci.plugins:swarm-client (3.40) +1 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (3107.v665000b_51092)

org.jenkins-ci.main:remoting MAVEN version 3107.v665000b51092 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - com.cloudbees:groovy-cps-dgm-builder =3691.v28b14c465abb, =5610.vae2be9e846fc,...

com.cloudbees:groovy-cps-dgm-builder (>=3653.v07ea_433c90b_4, <=3673.v5b_dd74276262) potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (3044.vb_940a_a_e4f72e)

org.jenkins-ci.main:remoting MAVEN version 3044.vb940aae4f72e is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - com.cloudbees:groovy-cps-dgm-builder =3653.v07ea433c90b4, =3673.v5bdd74276262 Source cves:...

com.cloudbees:groovy-cps-dgm-builder (>=3853.vb_a_490d892963, <=3908.vd6b_b_5a_a_54010), org.jenkins-ci:acceptance-test-harness (>=5658.v5b_fe603c573d, <=5678.v7d0d57b_a_f040) potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (3131.vf2b_b_798b_ce99)

org.jenkins-ci.main:remoting MAVEN version 3131.vf2bb798bce99 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - com.cloudbees:groovy-cps-dgm-builder =3853.vba490d892963, =5658.v5bfe603c573d,...

org.elasticsearch:elasticsearch-analysis-icu (0.8.0), org.elasticsearch:elasticsearch-client-groovy (0.8.0) +4 more potentially affected by CVE-2024-23444 via org.elasticsearch:elasticsearch (0.8.0)

org.elasticsearch:elasticsearch MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.8.0 - org.elasticsearch:elasticsearch-client-groov...