Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-24431A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate Maven · io.jenkins.plugins:macstadium-orka · fixed in 1.32
- CVE-2023-24432A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an atMaven · io.jenkins.plugins:macstadium-orka · fixed in 1.32
- CVE-2023-24433Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to aMaven · io.jenkins.plugins:macstadium-orka · fixed in 1.32
- CVE-2023-24434A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to conneMaven · org.jenkins-ci.plugins:ghprb
- CVE-2023-24435A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:ghprb
- CVE-2023-24436A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:ghprb
- CVE-2023-24437A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers tMaven · org.jenkins-ci.plugins:jira-steps
- CVE-2023-24438A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permisMaven · org.jenkins-ci.plugins:jira-steps
- CVE-2023-24439Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file onMaven · org.jenkins-ci.plugins:jira-steps
- CVE-2023-24440Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins cMaven · org.jenkins-ci.plugins:jira-steps
- CVE-2023-24441Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jvnet.hudson.plugins:mstest · fixed in 1.0.1
- CVE-2023-24442Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar pMaven · org.jenkins-ci.plugins:github-pr-coverage-status
- CVE-2023-24443Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:testcomplete · fixed in 2.9
- CVE-2023-24444Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:openid
- CVE-2023-24445Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.Maven · org.jenkins-ci.plugins:openid
- CVE-2023-24446A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in tMaven · org.jenkins-ci.plugins:openid
- CVE-2023-24447A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attaMaven · org.jenkins-ci.plugins:rabbitmq-consumer
- CVE-2023-24448A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to aMaven · org.jenkins-ci.plugins:rabbitmq-consumer
- CVE-2023-24449Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing Maven · org.jvnet.hudson.plugins:pwauth
- CVE-2023-24450Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be Maven · org.jenkins-ci.plugins:view-cloner
- CVE-2023-24451A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumeraMaven · org.jenkins-ci.plugins:cisco-spark-notifier-plugin
- CVE-2023-24452A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an atMaven · org.jenkins-ci.plugins:testquality-updater
- CVE-2023-24453A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attackeMaven · org.jenkins-ci.plugins:testquality-updater
- CVE-2023-24454Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on tMaven · org.jenkins-ci.plugins:testquality-updater
- CVE-2023-24455Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackersMaven · io.jenkins.plugins:visualexpert
- CVE-2023-24456Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:keycloak · fixed in 2.3.1
- CVE-2023-24457A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick userMaven · org.jenkins-ci.plugins:keycloak · fixed in 2.3.1
- CVE-2023-24458A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-sMaven · org.jenkins-ci.plugins:bearychat
- CVE-2023-24459A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:bearychat
- CVE-2022-47105Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.Maven · org.jeecgframework.boot:jeecg-boot-base-core, org.jeecgframework.boot:jeecg-module-system