Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-29518Code injection from view right using Invitation.InvitationCommon in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-invitation-ui · fixed in 13.10.11, 14.4.8, 14.10.1
- CVE-2023-29523Code injection in display method used in user profiles in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.11, 14.4.8, 14.10.2
- CVE-2023-29524Code injection from account through XWiki.SchedulerJobSheet in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-scheduler-ui · fixed in 14.10.3
- CVE-2023-29525Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-distribution-war, org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui · fixed in 13.10.11, 14.4.8, 14.6-rc-1 and more
- CVE-2023-29526Async and display macro allow displaying and interacting with any document in restricted modeMaven · org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-rendering-async-macro · fixed in 13.10.11, 14.4.8, 14.10.3
- CVE-2023-29527Code injection from account through AWM view sheet in xwiki platformMaven · org.xwiki.platform:xwiki-platform-appwithinminutes-ui · fixed in 14.10.3
- CVE-2023-26049Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse JettyMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.51.v20230217, 10.0.14, 11.0.14 and more
- CVE-2023-26048OutOfMemoryError for large multipart without filename in Eclipse JettyMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.51.v20230217, 10.0.14, 11.0.14
- CVE-2023-29213org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-logging-ui · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-22946Apache Spark proxy-user privilege escalation from malicious configuration classMaven · org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13 · fixed in 3.3.3
- CVE-2023-24831Apache IoTDB grafana-connector Login Bypass VulnerabilityMaven · org.apache.iotdb:iotdb-grafana-connector · fixed in 0.13.4
- CVE-2023-29511xwiki-platform-administration-ui vulnerable to privilege escalationMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 13.10.11, 14.4.8, 14.10.1
- CVE-2023-30537org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalationMaven · org.xwiki.platform:xwiki-platform-flamingo-theme-ui · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29509org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-flamingo-theme-ui · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29508org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site ScriptingMaven · org.xwiki.platform:xwiki-platform-livedata-macro · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29507org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthorsMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10, 14.4.7
- CVE-2023-29506org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpointsMaven · org.xwiki.platform:xwiki-platform-security-authentication-default · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29214org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-panels-ui · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29212xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-panels-ui · fixed in 14.4.7, 14.10
- CVE-2023-29211org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29210org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-notifications-ui · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29209org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29208Data leak through deleted documents Maven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-29207Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroMaven · org.xwiki.platform:xwiki-platform-flamingo, org.xwiki.platform:xwiki-platform-flamingo-skin +4 · fixed in 13.10.10, 14.4.6, 14.9
- CVE-2023-29206org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX pluginsMaven · org.xwiki.platform:xwiki-platform-skin-skinx · fixed in 14.9-rc-1
- CVE-2023-29205org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macroMaven · org.xwiki.platform:xwiki-platform-rendering-xwiki · fixed in 14.8-rc-1
- CVE-2023-29204URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcoreMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.10, 14.4.4, 14.8-rc-1
- CVE-2023-29203Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm Maven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 13.10.8, 14.4.3, 14.7-rc-1
- CVE-2023-29202org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityMaven · org.xwiki.platform:xwiki-core-rendering-macro-rss, org.xwiki.platform:xwiki-platform-rendering-macro-rss · fixed in 14.6-rc-1
- CVE-2023-29201org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityMaven · org.xwiki.commons:xwiki-commons-xml · fixed in 14.6-rc-1