Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25901Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function,Maven · org.webjars.npm:cookiejar
- CVE-2010-10006michaelliao jopenid OpenIdManager.java getAuthentication timing discrepancyMaven · org.expressme:jopenid · fixed in 1.08
- CVE-2023-22602Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP requestMaven · org.apache.shiro:shiro-root · fixed in 1.11.0
- CVE-2022-23532neo4j-apoc-procedures is vulnerable to path traversalMaven · org.neo4j.procedure:apoc · fixed in 4.3.0.12, 4.4.0.12
- CVE-2022-24913Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProviderMaven · com.fasterxml.util:java-merge-sort · fixed in 1.1.0
- CVE-2022-3143wildfly-elytron: possible timing attacks via use of unsafe comparator.Maven · org.wildfly.security:wildfly-elytron · fixed in 1.15.15.Final, 1.20.3.Final
- CVE-2023-0105A flaw was found in Keycloak.Maven · org.keycloak:keycloak-core · fixed in 22.0.1
- CVE-2023-0091A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow.Maven · org.keycloak:keycloak-core · fixed in 20.0.3
- CVE-2022-3782keycloak: path traversal via double URL encoding.Maven · org.keycloak:keycloak-parent · fixed in 20.0.2
- CVE-2023-22899Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.Maven · net.lingala.zip4j:zip4j · fixed in 2.11.3
- CVE-2022-46769Apache Sling App CMS: XSS in CMS Site Group DetailMaven · org.apache.sling:org.apache.sling.cms · fixed in 1.1.4
- CVE-2018-25068devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp fileMaven · com.anrisoftware.globalpom:globalpomutils · fixed in 4.5.1
- CVE-2016-15011e-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity referenceMaven · be.e_contract.dssp:dssp-client · fixed in 1.3.2
- CVE-2022-45935Apache James server: Temporary File Information DisclosureMaven · org.apache.james:james-server
- CVE-2022-45787Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProviderMaven · org.apache.james:apache-mime4j-storage · fixed in 0.8.9
- CVE-2020-36641gturri aXMLRPC ResponseParser.java ResponseParser xml external entity referenceMaven · fr.turri:axmlrpc · fixed in 1.12.1
- CVE-2020-36640bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity referenceMaven · org.bonitasoft.connectors:bonita-connector-webservice · fixed in 1.3.1
- CVE-2021-32828Regular expression Denial of Service in MooToolsMaven · org.nuxeo.ecm.platform:nuxeo-platform-oauth
- CVE-2023-22465Http4s has fatal error parsing User-Agent and Server headersMaven · org.http4s:http4s-core, org.http4s:http4s-core_2.10 +3 · fixed in 0.21.34, 0.22.15, 0.23.17 and more
- CVE-2022-45875Apache DolphinScheduler: Remote command execution Vulnerability in script alert pluginMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.0.2, 3.1.1
- CVE-2023-22457org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request ForgeryMaven · org.xwiki.contrib:application-ckeditor-ui · fixed in 1.64.3
- CVE-2022-45143Apache Tomcat: JsonErrorReportValve escapingMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina +1 · fixed in 8.5.84, 9.0.69, 10.1.2
- CVE-2021-32824Regular expression Denial of Service in MooToolsMaven · org.apache.dubbo:dubbo-parent · fixed in 2.6.10, 2.7.10
- CVE-2022-38723Gravitee API Management before 3.15.13 allows path traversal through HTML injection.Maven · io.gravitee.apim:gravitee-api-management · fixed in 3.15.13
- CVE-2017-20151iText RUPS XfaFile.java xml external entity referenceMaven · com.itextpdf:itext-rups
- CVE-2022-44621Apache Kylin: Command injection by Diagnosis ControllerMaven · org.apache.kylin:kylin-server-base · fixed in 4.0.3
- CVE-2022-43396Apache Kylin: Command injection by Useless configurationMaven · org.apache.kylin:kylin · fixed in 4.0.3
- CVE-2022-46178Path Traversal In MeterSpere allows file upload to any pathMaven · io.metersphere:metersphere · fixed in 2.5.1
- CVE-2022-36437The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster Maven · com.hazelcast.jet:hazelcast-jet, com.hazelcast.jet:hazelcast-jet-enterprise +2 · fixed in 4.5.4, 3.12.13, 4.1.10 and more
- CVE-2022-23554Authentication bypass in AlpineMaven · us.springett:alpine · fixed in 1.10.4