Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-28679Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custoMaven · javagh.jenkins:mashup-portlets-plugin
- CVE-2023-28678Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resultMaven · org.jenkins-ci.plugins:cppcheck
- CVE-2023-28677Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build SMaven · org.jenkins-ci.plugins:convert-to-pipeline
- CVE-2023-28676A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a PipelinMaven · org.jenkins-ci.plugins:convert-to-pipeline
- CVE-2023-28675A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously confMaven · org.jenkinsci.plugins:octoperf · fixed in 4.5.3
- CVE-2023-28674A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to conneMaven · org.jenkinsci.plugins:octoperf · fixed in 4.5.3
- CVE-2023-28673A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission toMaven · org.jenkinsci.plugins:octoperf · fixed in 4.5.3
- CVE-2023-28672Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowiMaven · org.jenkinsci.plugins:octoperf · fixed in 4.5.2
- CVE-2023-28671A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to conneMaven · org.jenkinsci.plugins:octoperf · fixed in 4.5.1
- CVE-2023-28670Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScriptMaven · com.paul8620.jenkins.plugins:pipeline-aggregator-view · fixed in 1.14
- CVE-2023-28669Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (Maven · org.jenkins-ci.plugins:jacoco · fixed in 3.3.2.1
- CVE-2023-28668Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.Maven · org.jenkins-ci.plugins:role-strategy · fixed in 587.588.v850a_20a_30162
- CVE-2023-20859In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertiMaven · org.springframework.vault:spring-vault-core · fixed in 3.0.2, 2.3.3
- CVE-2023-20861In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible fMaven · org.springframework:spring-expression · fixed in 6.0.7, 5.3.26, 5.2.23.RELEASE
- CVE-2023-27094An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management moMaven · cn.hippo4j:hippo4j-all
- CVE-2023-0870Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)Maven · org.opennms:opennms-webapp · fixed in 31.0.6
- CVE-2023-28708Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsMaven · org.apache.tomcat:tomcat-catalina · fixed in 11.0.0-M3, 10.1.6, 9.0.72 and more
- CVE-2023-28685Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:absint-a3
- CVE-2023-27087Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageLMaven · com.xuxueli:xxl-job
- CVE-2023-28118kaml has potential denial of service while parsing input with anchors and aliases Maven · com.charleskorn.kaml:kaml · fixed in 0.53.0
- CVE-2023-26513Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoSMaven · org.apache.sling:org.apache.sling.resourcemerger · fixed in 1.4.2
- CVE-2021-46877jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.12.6, 2.13.1
- CVE-2023-1454jeecg-boot qurestSql sql injectionMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-1436Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArrayMaven · org.codehaus.jettison:jettison · fixed in 1.5.4
- CVE-2023-27095Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UsMaven · cn.hippo4j:hippo4j-core
- CVE-2023-0100In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTMaven · org.eclipse.birt:org.eclipse.birt.report.viewer · fixed in 4.13
- CVE-2023-24279A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbiMaven · org.onosproject:onos-archetypes
- CVE-2023-1370Stack exhaustion in json-smart leads to denial of service when parsing malformed JSONMaven · net.minidev:json-smart · fixed in 2.4.9
- CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppenderMaven · log4j:log4j, org.apache.logging.log4j:log4j-core · fixed in 2.0
- CVE-2023-27905Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resultinMaven · org.jenkins-ci:update-center2 · fixed in 3.15