CVE-2025-23215

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

ch.acanda.maven:code-analysis-maven-plugin (>=1.6.0 <=1.6.1), net.sourceforge.pmd:pmd-cli (>=7.0.0 <=7.1.0) +1 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-designer (=7.0.0)

net.sourceforge.pmd:pmd-designer MAVEN version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-designer and may be impacted: - ch.acanda.maven:code-analysis-maven-plugin =1.6.0, =7.0.0, =7.0.0, =7.1.0 Source cves:...

ch.acanda.maven:code-analysis-maven-plugin (>=0.1.0 <=1.6.1), com.eventoframework:evento-cli (>=ev1.4.1 <=ev1.15.5) +105 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-core (>=6.21.0 <=7.0.0)

net.sourceforge.pmd:pmd-core MAVEN version =6.21.0, =0.1.0, =ev1.4.1, =ev1.4.1, =2.17.0, =1.1.0, =1.0.2, =1.2.0, =0.18, =0.18, =0.18, =2.10.2, =2.6.1, =2.19.0 and more Source cves: CVE-2025-23215 Source advisory: OSV:GHSA-88M4-H43F-WX84...

CVE-2025-23215

creationtimestamp| type| source ---|---|--- 2025-01-31 16:16:27+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lh2fipn4fl2n 2025-01-31 19:34:28+00:00| seen| https://t.me/cvedetector/16967 2025-01-31 19:35:26+00:00| seen|...

CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...