Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-26120This affects all versions of the package com.xuxueli:xxl-job.Maven · com.xuxueli:xxl-job
- CVE-2023-29016Goobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesMaven · io.goobi.viewer:viewer-core · fixed in 23.03
- CVE-2023-29015Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments Maven · io.goobi.viewer:viewer-core · fixed in 23.03
- CVE-2023-29014Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID ParameterMaven · io.goobi.viewer:viewer-core · fixed in 23.03
- CVE-2023-25330A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuMaven · com.baomidou:mybatis-plus · fixed in 3.5.3.1
- CVE-2020-20913SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.Maven · net.mingsoft:ms-mcms · fixed in 5.1
- CVE-2023-26269Apache James server: Privilege escalation through unauthenticated JMXMaven · org.apache.james:javax-mail-extension · fixed in 3.7.4
- CVE-2023-26119Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, whMaven · net.sourceforge.htmlunit:htmlunit · fixed in 3.0.0
- CVE-2023-27025An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrarMaven · com.ruoyi:ruoyi · fixed in 4.7.7
- CVE-2023-1784jeecg-boot API Documentation improper authenticationMaven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-27162openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}.Maven · org.openapitools:openapi-generator-project
- CVE-2023-1741jeecg-boot Sleep Command SysDictMapper.java sql injectionMaven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-28935Apache UIMA DUCC: DUCC (EOL) allows RCEMaven · org.apache.uima:uima-ducc-parent
- CVE-2023-28462A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 andMaven · fish.payara.server:payara-aggregator · fixed in 6.2022.1.Alpha3
- CVE-2023-28158Apache Archiva privilege escalationMaven · org.apache.archiva:archiva · fixed in 2.2.10
- CVE-2022-1274A flaw was found in Keycloak in the execute-actions-email endpoint.Maven · org.keycloak:keycloak-services · fixed in 20.0.5
- CVE-2023-28326Apache OpenMeetings: allows user impersonationMaven · org.apache.openmeetings:openmeetings-parent · fixed in 7.0.0
- CVE-2023-25721Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and whMaven · com.veracode.jenkins:veracode-scan · fixed in 23.3.19.0
- CVE-2023-25722A credential-leak issue was discovered in related Veracode products before 2023-03-27.Maven · com.veracode.jenkins:veracode-scan · fixed in 23.3.19.0
- CVE-2023-28640Permissions bypass in Apiman could enable authenticated attacker to unpermitted API KeyMaven · io.apiman:apiman-manager-api-rest-impl · fixed in 3.1.0.Final
- CVE-2023-28628`authority-regex` returns the wrong authority in lambdaisland/uriMaven · lambdaisland:uri · fixed in 1.14.120
- CVE-2023-27296Apache InLong: JDBC Deserialization Vulnerability in InLongMaven · org.apache.inlong:inlong-manager · fixed in 1.6.0
- CVE-2023-20860Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequesMaven · org.springframework:spring, org.springframework:spring-webmvc · fixed in 6.0.7, 5.3.26
- CVE-2023-27096Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyCoMaven · cn.hippo4j:hippo4j-all
- CVE-2023-28867In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption.Maven · com.graphql-java:graphql-java · fixed in 0.0.0-2023-03-20T01-49-44-80e3135, 17.5, 18.4 and more
- CVE-2023-28684Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.sap.jenkinsci:remote-jobs-view-plugin
- CVE-2023-28683Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:phabricator-plugin
- CVE-2023-28682Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:perfpublisher
- CVE-2023-28681Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:vs-code-metrics
- CVE-2023-28680Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:crap4j