Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-25621Apache Sling does not allow to handle i18n content in a secure wayMaven · org.apache.sling:org.apache.sling.i18n · fixed in 2.6.2
- CVE-2022-4492The undertow client is not checking the server identity presented by the server certificate in https connections.Maven · io.undertow:undertow-core · fixed in 2.3.5.Final, 2.2.24.Final
- CVE-2023-0044If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead toMaven · io.quarkus:quarkus-vertx-http · fixed in 2.13.7.Final
- CVE-2023-0846Unauthenticated, stored XSS in display of alarm reduction-keyMaven · org.opennms:opennms · fixed in 31.0.3
- CVE-2023-25157Unfiltered SQL Injection Vulnerabilities in GeoserverMaven · org.geoserver.community:gs-jdbcconfig · fixed in 2.21.4, 2.22.2
- CVE-2023-25158Unfiltered SQL Injection in GeotoolsMaven · org.geotools:gt-jdbc · fixed in 28.2, 27.4, 26.7 and more
- CVE-2023-24998Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsMaven · commons-fileupload:commons-fileupload, org.apache.tomcat.embed:tomcat-embed-core +2 · fixed in 1.5, 10.1.5, 11.0.0-M5 and more
- CVE-2023-25613LDAP Injection Vulnerability in Apache KerbyMaven · org.apache.kerby:ldap-backend · fixed in 2.0.3
- CVE-2023-25570Apollo has potential access control security issue in eurekaMaven · com.ctrip.framework.apollo:apollo · fixed in 2.1.0
- CVE-2023-25569apollo-portal has potential CSRF issueMaven · com.ctrip.framework.apollo:apollo · fixed in 2.1.0
- CVE-2016-150263breadt dd-plist xml external entity referenceMaven · com.googlecode.plist:dd-plist · fixed in 1.18
- CVE-2014-125087java-xmlbuilder xml external entity referenceMaven · com.jamesmurty.utils:java-xmlbuilder · fixed in 1.2
- CVE-2023-0482In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates teMaven · org.jboss.resteasy:resteasy-core, org.jboss.resteasy:resteasy-multipart-provider · fixed in 6.2.3.Final, 5.0.6.Final, 4.7.8.Final and more
- CVE-2023-23926APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j.Maven · org.neo4j.procedure:apoc-core · fixed in 5.5.0, 4.4.0.14
- CVE-2022-42735Apache ShenYu Admin ultra viresMaven · org.apache.shenyu:shenyu-admin · fixed in 2.5.1
- CVE-2023-23847A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an atMaven · org.jenkins-ci.plugins:synopsys-coverity · fixed in 3.0.3
- CVE-2023-23848Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to aMaven · org.jenkins-ci.plugins:synopsys-coverity · fixed in 3.0.3
- CVE-2023-23850A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate Maven · org.jenkins-ci.plugins:synopsys-coverity · fixed in 3.0.3
- CVE-2023-25761Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored Maven · org.jenkins-ci.plugins:junit · fixed in 1166.1168.vd6b_8042a_06de
- CVE-2023-25762Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet GenerMaven · org.jenkins-ci.plugins:pipeline-build-step · fixed in 2.18.1
- CVE-2023-25763Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored crMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.94
- CVE-2023-25764Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generatedMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.94
- CVE-2023-25765In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowiMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.94
- CVE-2023-25766A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission tMaven · org.jenkins-ci.plugins:azure-credentials · fixed in 254.v64da
- CVE-2023-25767A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connMaven · org.jenkins-ci.plugins:azure-credentials · fixed in 254.v64da_8176c83a
- CVE-2023-25768A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission tMaven · org.jenkins-ci.plugins:azure-credentials · fixed in 254.v64da_8176c83a
- CVE-2023-25141JNDI injection into Apache sling-org-apache-sling-jcr-baseMaven · org.apache.sling:org.apache.sling.jcr.base · fixed in 3.1.12
- CVE-2023-24187An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to Maven · com.bstek.ureport:ureport2-core
- CVE-2023-24188ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to bMaven · com.bstek.ureport:ureport2-core
- CVE-2022-4903CodenameOne implicit intent for sensitive communicationMaven · com.codenameone:codenameone-core · fixed in 7.0.71