Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-22832Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributesMaven · org.apache.nifi:nifi-ccda-processors · fixed in 1.20.0
- CVE-2023-24815Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-webMaven · io.vertx:vertx-web · fixed in 4.3.8
- CVE-2023-25194Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect Maven · org.apache.kafka:connect · fixed in 3.4.0
- CVE-2023-22849Apache Sling App CMS: XSS in CMS Reference / UI ComponentsMaven · org.apache.sling:org.apache.sling.cms · fixed in 1.1.6
- CVE-2023-0674XXL-JOB New Password updatePwd cross-site request forgeryMaven · com.xuxueli:xxl-job
- CVE-2021-37304An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive infMaven · org.jeecgframework.boot:jeecg-boot-base
- CVE-2021-37305An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive informaMaven · org.jeecgframework.boot:jeecg-boot-base
- CVE-2021-37306An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive informaMaven · org.jeecgframework.boot:jeecg-boot-base
- CVE-2023-24997Apache InLong: Jdbc Connection Security BypassMaven · org.apache.inlong:inlong
- CVE-2023-24977Apache InLong: Jdbc Connection causes arbitrary file reading in InLongMaven · org.apache.inlong:inlong
- CVE-2022-44644Apache Linkis (incubating): The DatasourceManager module has a Local File Read VulnerabilityMaven · org.apache.linkis:linkis · fixed in 1.3.1
- CVE-2022-44645Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerabilityMaven · org.apache.linkis:linkis · fixed in 1.3.1
- CVE-2022-25881This affects versions of the package http-cache-semantics before 4.1.1.Maven · org.webjars.npm:http-cache-semantics · fixed in 4.1.1
- CVE-2023-24162Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameteMaven · cn.hutool:hutool-all
- CVE-2023-24163SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.Maven · cn.hutool:hutool-all · fixed in 5.8.21
- CVE-2022-2712In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path stMaven · org.glassfish.main.web:web · fixed in 7.0.0
- CVE-2022-25894All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jeMaven · com.bstek.uflo:uflo-core
- CVE-2023-23612Issue with whitespace in JWT roles in OpenSearchMaven · org.opensearch.plugin:opensearch-security · fixed in 1.3.8, 2.5.0
- CVE-2023-23613Field-level security issue with .keyword fields in OpenSearchMaven · org.opensearch.plugin:opensearch-security · fixed in 1.3.8, 2.5.0
- CVE-2022-47042MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.Maven · net.mingsoft:ms-mcms · fixed in 5.2.11
- CVE-2023-24057HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal fMaven · ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.core +5 · fixed in 5.6.92, 1.2.30
- CVE-2023-24422A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackerMaven · org.jenkins-ci.plugins:script-security · fixed in 1229.v4880b
- CVE-2023-24423A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous bMaven · com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger · fixed in 2.38.1
- CVE-2023-24424Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:oic-auth · fixed in 2.5
- CVE-2023-24425Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentiaMaven · com.cloudbees.jenkins.plugins:kubernetes-credentials-provider · fixed in 1.209.v862c6e5fb
- CVE-2023-24426Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:azure-ad
- CVE-2023-24427Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:bitbucket-oauth · fixed in 0.13
- CVE-2023-24428A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into loMaven · org.jenkins-ci.plugins:bitbucket-oauth · fixed in 0.13
- CVE-2023-24429Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no Maven · org.jenkins-ci.plugins:semantic-versioning-plugin · fixed in 1.15
- CVE-2023-24430Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:semantic-versioning-plugin · fixed in 1.15