Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-30331An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.Maven · com.ibeetl:beetl
- CVE-2023-25827Cross-site Scripting in OpenTSDBMaven · net.opentsdb:opentsdb
- CVE-2023-25826Remote Code Execution in OpenTSDBMaven · net.opentsdb:opentsdb
- CVE-2023-32007Apache Spark: Shell command injection via Spark UIMaven · org.apache.spark:spark-parent_2.12 · fixed in 3.2.2
- CVE-2022-46365Apache StreamPark (incubating): Logic error causing any account resetMaven · org.apache.streampark:streampark · fixed in 2.0.0
- CVE-2022-45801Apache StreamPark (incubating): LDAP Injection VulnerabilityMaven · org.apache.streampark:streampark · fixed in 2.0.0
- CVE-2022-45802Apache StreamPark (incubating): Upload any file to any directoryMaven · org.apache.streampark:streampark-common_2.11, org.apache.streampark:streampark-common_2.12 · fixed in 2.0.0
- CVE-2023-29471Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain clearMaven · com.typesafe.akka:akka-stream-kafka_2.11, com.typesafe.akka:akka-stream-kafka_2.12 +2 · fixed in 4.0.2
- CVE-2023-30349JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2023-22665Apache Jena: Exposure of arbitrary execution in script engine expressions.Maven · org.apache.jena:jena · fixed in 4.8.0
- CVE-2023-29924PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.Maven · tech.powerjob:powerjob
- CVE-2023-29528Cross-site Scripting in org.xwiki.commons:xwiki-commons-xmlMaven · org.xwiki.commons:xwiki-commons-xml · fixed in 14.10
- CVE-2023-25601Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authenticationMaven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 3.1.2
- CVE-2023-20873In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry coulMaven · org.springframework.boot:spring-boot-actuator-autoconfigure · fixed in 3.0.6, 2.7.11, 2.6.15 and more
- CVE-2023-29926PowerJob V4.3.2 has unauthorized interface that causes remote code execution.Maven · tech.powerjob:powerjob
- CVE-2023-20862In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support doesMaven · org.springframework.security:spring-security-core · fixed in 5.7.8, 5.8.3, 6.0.3
- CVE-2023-29921PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.Maven · tech.powerjob:powerjob
- CVE-2023-29922PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.Maven · tech.powerjob:powerjob
- CVE-2023-29923PowerJob V4.3.1 is vulnerable to Insecure Permissions.Maven · tech.powerjob:powerjob
- CVE-2023-29517Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewerMaven · org.xwiki.platform:xwiki-platform-office-viewer · fixed in 13.10.11, 14.4.8, 14.10.1
- CVE-2023-29516Code injection from view right on XWiki.AttachmentSelector in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-attachment-ui · fixed in 13.10.11, 14.4.8, 14.10.1
- CVE-2023-29515Cross-site scripting (XSS) in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-appwithinminutes, org.xwiki.platform:xwiki-platform-appwithinminutes-ui · fixed in 4.2-milestone-1, 13.10.11, 14.4.8 and more
- CVE-2023-29514Code injection in template provider administration in xwiki-platformMaven · org.xwiki.platform.applications:xwiki-application-administration, org.xwiki.platform:xwiki-platform-administration +1 · fixed in 13.10.11, 14.4.8, 14.10.1
- CVE-2023-29513Users can be created even when registration is disabled without validation via the template macro in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.10.1
- CVE-2023-29512Code injection in xwiki-platform-web-templatesMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 13.10.11, 14.4.8, 14.10.1
- CVE-2023-29510Code injection via unescaped translations in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 14.10.2
- CVE-2023-29522Code injection from view right on XWiki.ClassSheet in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-xclass-ui · fixed in 14.4.8, 14.10.3
- CVE-2023-29521Code injection from account/view through VFS Tree macro in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-vfs-ui · fixed in 13.10.11, 14.4.8, 14.10.2
- CVE-2023-29520Page render failure due to broken translations in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-localization-source-wiki · fixed in 13.10.11, 14.4.8, 14.10.1
- CVE-2023-29519Code injection in org.xwiki.platform:xwiki-platform-attachment-uiMaven · org.xwiki.platform:xwiki-platform-attachment-ui · fixed in 13.10.11, 14.4.8, 14.10.2