Skip to content

FISH-12928 Add PR link #721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Pandrex247 wants to merge 1 commit into
base: main-7
Choose a base branch
from
Open

FISH-12928 Add PR link #721

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion community/docs/modules/ROOT/pages/Security/Security Fix List.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ The following is a list of reported _**C**ommon **V**ulnerabilities and **E**xpo

|https://nvd.nist.gov/vuln/detail/CVE-2020-5258[CVE-2020-5258] | 7.7 | FIXED | The dojo library used in the Payara Server Administration Console contains a `deepCopy` method vulnerable to Prototype Pollution. | 7.2026.1 | https://github.com/payara/Payara/pull/7785[#7785] | Fixed by upgrading the dojo library.

|https://nvd.nist.gov/vuln/detail/CVE-2025-14340[CVE-2025-14340] | 9.3 | FIXED | A Cross-Site Scripting vulnerability in Payara’s Administration Rest Interface, allows execution of attacker-controlled JavaScript leading to admin account takeover. | 7.2026.1 | - | Fixed by encoding the error message in Payara Server.
|https://nvd.nist.gov/vuln/detail/CVE-2025-14340[CVE-2025-14340] | 9.3 | FIXED | A Cross-Site Scripting vulnerability in Payara’s Administration Rest Interface, allows execution of attacker-controlled JavaScript leading to admin account takeover. | 7.2026.1 | https://github.com/payara/Payara/pull/7816[#7816] | Fixed by encoding the error message in Payara Server.

|https://nvd.nist.gov/vuln/detail/CVE-2020-36843[CVE-2020-36843] | 4.3 | FIXED | The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. | 7.2025.2 | https://github.com/payara/Payara/pull/7779[#7779] | Fixed by upgrading dependency for eddsa used by Trilead SSH in Payara Server.

Expand Down