Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-32989A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to conneMaven · org.jenkins-ci.plugins:azure-vm-agents · fixed in 853.v4a
- CVE-2023-32988A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:azure-vm-agents · fixed in 853.v4a
- CVE-2023-32987A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an aMaven · org.jenkins-ci.plugins:reverse-proxy-auth-plugin · fixed in 1.7.5
- CVE-2023-32986Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Maven · io.jenkins.plugins:file-parameters · fixed in 285.287.v4b
- CVE-2023-32985Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackeMaven · org.jenkins-ci.plugins:sidebar-link · fixed in 2.2.2
- CVE-2023-32984Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and dispMaven · org.jenkins-ci.plugins:testng-plugin · fixed in 730.732.v959a
- CVE-2023-32983Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the poteMaven · org.jenkins-ci.plugins:ansible · fixed in 205.v4cb
- CVE-2023-32982Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller wMaven · org.jenkins-ci.plugins:ansible · fixed in 205.v4cb
- CVE-2023-32981An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted aMaven · org.jenkins-ci.plugins:pipeline-utility-steps · fixed in 2.15.3
- CVE-2023-32980A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an aMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.96.1
- CVE-2023-32979Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with OverallMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.96.1
- CVE-2023-32978A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server usMaven · org.jenkins-ci.plugins:ldap · fixed in 676.vfa
- CVE-2023-32977Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a storedMaven · org.jenkins-ci.plugins.workflow:workflow-job · fixed in 1295.v395eb
- CVE-2023-31544A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML viaMaven · org.opencms:opencms-core · fixed in 11.0.1
- CVE-2023-31890An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() pMaven · com.glazedlists:glazedlists
- CVE-2023-32068URL Redirection to Untrusted Site in XWikiMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.4
- CVE-2022-47937Multiple parsing problems in the Apache Sling Commons JSON moduleMaven · org.apache.sling:org.apache.sling.commons.json
- CVE-2023-32081Vert.x STOMP server process client frames that would not send initially a connect frameMaven · io.vertx:vertx-stomp · fixed in 3.9.16, 4.4.2
- CVE-2023-28936Apache OpenMeetings: insufficient check of invitation hashMaven · org.apache.openmeetings:openmeetings-db · fixed in 7.1.0
- CVE-2023-29032Apache OpenMeetings: allows bypass authenticationMaven · org.apache.openmeetings:openmeetings-parent · fixed in 7.1.0
- CVE-2023-29246Apache OpenMeetings: allows null-byte InjectionMaven · org.apache.openmeetings:openmeetings-parent · fixed in 7.1.0
- CVE-2023-32070Improper Neutralization of Script in Attributes in XWiki (X)HTML renderersMaven · org.xwiki.platform:xwiki-core-rendering-api, org.xwiki.platform:xwiki-platform-annotation-core +5 · fixed in 14.6-rc-1
- CVE-2023-32071XWiki Platform vulnerable to RXSS via editor parameter - importinline templateMaven · org.xwiki.platform:xwiki-platform-distribution-war · fixed in 14.4.8, 14.10.4
- CVE-2023-32069XWiki Platform privilege escalation (PR)/RCE from account through class sheetMaven · org.xwiki.platform:xwiki-platform-test-ui · fixed in 14.10.4
- CVE-2023-31126Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xmlMaven · org.xwiki.commons:xwiki-commons-xml · fixed in 14.10.4
- CVE-2023-31141OpenSearch issue with fine-grained access control during extremely rare race conditionsMaven · org.opensearch.plugin:opensearch-security · fixed in 1.3.10.0, 2.7.0.0
- CVE-2020-22755File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.Maven · net.mingsoft:ms-mcms
- CVE-2021-40331Permissions problem in the Apache Ranger Hive PluginMaven · org.apache.ranger:ranger-hive-plugin · fixed in 2.4.0
- CVE-2022-45048Apache Ranger: code execution vulnerability in policy expressionsMaven · org.apache.ranger:ranger · fixed in 2.4.0
- CVE-2023-30093A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbiMaven · org.onosproject:onos-archetypes