Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-30535Snowflake JDBC vulnerable to command injection via SSO URL authenticationMaven · net.snowflake:snowflake-jdbc · fixed in 3.13.29
- CVE-2022-45064Apache Sling Engine: Include-based XSSMaven · org.apache.sling:org.apache.sling.engine · fixed in 2.14.0
- CVE-2023-20863In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL exMaven · org.springframework:spring-expression · fixed in 6.0.8, 5.3.27, 5.2.24.RELEASE
- CVE-2023-20866In Spring Session version 3.0.0, the session id can be logged to the standard output stream.Maven · org.springframework.session:spring-session-core · fixed in 3.0.1
- CVE-2023-30532A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobMaven · org.jenkinsci.plugins.spoonscript:spoonscript
- CVE-2023-30531Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasinMaven · org.jenkins-ci.plugins:consul-kv-builder
- CVE-2023-30530Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on thMaven · org.jenkins-ci.plugins:consul-kv-builder
- CVE-2023-30529Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reinMaven · org.jenkins-ci.plugins:lucene-search · fixed in 398.v3dfa_cb_223984
- CVE-2023-30528Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potentMaven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-30527Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins contrMaven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-30526A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an atMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30525A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attackerMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30524Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the poMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30523Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controllerMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30522A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobsMaven · org.jenkins-ci.plugins:fogbugz
- CVE-2023-30521A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger bMaven · org.jenkins-ci.plugins:assembla-merge-request-builder
- CVE-2023-30520Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhookMaven · org.jenkins-ci.plugins:quayio-trigger
- CVE-2023-30519A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corrMaven · org.jenkins-ci.plugins:quayio-trigger
- CVE-2023-30518A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumeMaven · io.jenkins.plugins:thycotic-secret-server
- CVE-2023-30517Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when coMaven · io.jenkins.plugins:neuvector-vulnerability-scanner
- CVE-2023-30516Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to DockeMaven · org.jenkins-ci.plugins:image-tag-parameter
- CVE-2023-30515Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the builMaven · io.jenkins.plugins:thycotic-devops-secrets-vault
- CVE-2023-30514Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the builMaven · org.jenkins-ci.plugins:azure-keyvault · fixed in 188.vf46b
- CVE-2023-30513Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log Maven · org.csanchez.jenkins.plugins:kubernetes · fixed in 3910.ve59cec5e33ea
- CVE-2023-30465Apache InLong: SQL injection in apache inLong 1.5.0Maven · org.apache.inlong:manager-pojo, org.apache.inlong:manager-service · fixed in 1.6.0
- CVE-2023-29216Apache Linkis DatasourceManager module has a deserialization command executionMaven · org.apache.linkis:linkis-datasource · fixed in 1.3.2
- CVE-2023-27987Apache Linkis gateway module token authentication bypassMaven · org.apache.linkis:linkis · fixed in 1.3.2
- CVE-2023-27603Apache Linkis Mangaer module engineConn material upload exists Zip Slip issueMaven · org.apache.linkis:linkis · fixed in 1.3.2
- CVE-2023-27602Apache Linkis publicsercice module unrestricted upload of fileMaven · org.apache.linkis:linkis · fixed in 1.3.2
- CVE-2023-29215Apache Linkis JDBC EngineCon has a deserialization command executionMaven · org.apache.linkis:linkis-engineconn · fixed in 1.3.2