Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-27904Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.387.1, 2.375.4, 2.394
- CVE-2023-27903Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.387.1, 2.375.4, 2.394
- CVE-2023-27902Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/WMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.387.1, 2.375.4, 2.394
- CVE-2023-27901Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.394, 2.375.4, 2.387.1
- CVE-2023-27900Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.394, 2.375.4, 2.387.1
- CVE-2023-27899Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.387.1, 2.375.4, 2.394
- CVE-2023-27898Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depeMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.394, 2.375.4
- CVE-2023-23638Apache Dubbo Deserialization Vulnerability Gadgets BypassMaven · org.apache.dubbo:dubbo · fixed in 2.7.22, 3.0.13, 3.1.5
- CVE-2023-27480Data leak through a XAR import XXE attack in xwiki-platform-xar-modelMaven · org.xwiki.platform:xwiki-platform-xar-model · fixed in 13.10.11, 14.4.7, 14.10-rc-1
- CVE-2023-27479Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-uiMaven · org.xwiki.platform:xwiki-platform-panels-ui · fixed in 13.10.11, 14.4.7, 14.10-rc-1
- CVE-2023-24789jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-26055XWiki Commons may allow privilege escalation to programming rights via user's first nameMaven · org.xwiki.commons:xwiki-commons-xml · fixed in 13.10.9, 14.4.4, 14.7-rc-1
- CVE-2023-26056XWiki Platform allows macro execution as any user without programming rights through the context macroMaven · org.xwiki.platform:xwiki-platform-rendering-macro-context · fixed in 13.10.10, 14.4.5, 14.8-rc-1
- CVE-2023-26470In XWiki Platform, saving a document with a large object number leads to persistent OOM errorsMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.0-rc-1
- CVE-2023-26471XWiki Platform users may execute anything with superadmin right through comments and async macroMaven · org.xwiki.platform:xwiki-platform-rendering-async-macro · fixed in 13.10.10, 14.4.6, 14.9
- CVE-2023-26472XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profileMaven · org.xwiki.platform:xwiki-platform-icon-ui · fixed in 13.10.10, 14.4.6, 14.9
- CVE-2023-26473XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vmMaven · org.xwiki.platform:xwiki-platform-web · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-26474XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorMaven · org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-26475XWiki Platform vulnerable to Remote Code Execution in AnnotationsMaven · org.xwiki.platform:xwiki-platform-annotation-ui · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2023-26476Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized ActorMaven · org.xwiki.platform:xwiki-platform-livetable-ui, org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki · fixed in 13.4.4, 13.10.9, 14.7-rc-1
- CVE-2023-26477org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-flamingo-theme-ui · fixed in 13.10.10, 14.4.6, 14.9-rc-1
- CVE-2023-26478org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or FunctionMaven · org.xwiki.platform:xwiki-platform-store-filesystem-oldcore · fixed in 14.4.6, 14.9-rc-1
- CVE-2023-26479org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional ConditionsMaven · org.xwiki.platform:xwiki-platform-rendering-parser · fixed in 13.10.10, 14.4.6, 14.9-rc-1
- CVE-2023-26480XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live DataMaven · org.xwiki.platform:xwiki-platform-livedata-macro · fixed in 13.10.10, 14.4.7, 14.9
- CVE-2023-25806Time discrepancy in authentication responses in OpenSearchMaven · org.opensearch.plugin:opensearch-security · fixed in 1.3.9, 2.6.0
- CVE-2023-0481In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp fiMaven · io.quarkus.resteasy.reactive:resteasy-reactive-common · fixed in 3.0.0.Alpha4
- CVE-2023-0815Plaintext Password Present in the Web logsMaven · org.opennms:opennms · fixed in 31.0.4
- CVE-2023-0867Multiple stored and reflected Cross-site Scripting in webappMaven · org.opennms:opennms · fixed in 31.0.4
- CVE-2023-0868Stealing Cookies using Reflected XSS via graph resultsMaven · org.opennms:opennms-webapp · fixed in 31.0.4
- CVE-2023-0869Cross-site scripting in outage/list.htmMaven · org.opennms:opennms-web-api