diff --git a/community/docs/modules/ROOT/pages/Security/Security Fix List.adoc b/community/docs/modules/ROOT/pages/Security/Security Fix List.adoc index da917a09d..fcc8e6e04 100644 --- a/community/docs/modules/ROOT/pages/Security/Security Fix List.adoc +++ b/community/docs/modules/ROOT/pages/Security/Security Fix List.adoc @@ -11,7 +11,7 @@ The following is a list of reported _**C**ommon **V**ulnerabilities and **E**xpo |https://nvd.nist.gov/vuln/detail/CVE-2020-5258[CVE-2020-5258] | 7.7 | FIXED | The dojo library used in the Payara Server Administration Console contains a `deepCopy` method vulnerable to Prototype Pollution. | 7.2026.1 | https://github.com/payara/Payara/pull/7785[#7785] | Fixed by upgrading the dojo library. -|https://nvd.nist.gov/vuln/detail/CVE-2025-14340[CVE-2025-14340] | 9.3 | FIXED | A Cross-Site Scripting vulnerability in Payara’s Administration Rest Interface, allows execution of attacker-controlled JavaScript leading to admin account takeover. | 7.2026.1 | - | Fixed by encoding the error message in Payara Server. +|https://nvd.nist.gov/vuln/detail/CVE-2025-14340[CVE-2025-14340] | 9.3 | FIXED | A Cross-Site Scripting vulnerability in Payara’s Administration Rest Interface, allows execution of attacker-controlled JavaScript leading to admin account takeover. | 7.2026.1 | https://github.com/payara/Payara/pull/7816[#7816] | Fixed by encoding the error message in Payara Server. |https://nvd.nist.gov/vuln/detail/CVE-2020-36843[CVE-2020-36843] | 4.3 | FIXED | The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. | 7.2025.2 | https://github.com/payara/Payara/pull/7779[#7779] | Fixed by upgrading dependency for eddsa used by Trilead SSH in Payara Server.