Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-23553URL access filters bypass in AlpineMaven · us.springett:alpine · fixed in 1.10.4
- CVE-2022-41966XStream Denial of Service via stack overflow Maven · com.thoughtworks.xstream:xstream · fixed in 1.4.20
- CVE-2022-4772Widoco WidocoUtils.java unZipIt path traversalMaven · com.github.dgarijo:widoco
- CVE-2020-10650A deserialization flaw was discovered in jackson-databind through 2.9.10.4.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-28191The console in Togglz before 2.9.4 allows CSRF.Maven · org.togglz:togglz-console · fixed in 2.9.4
- CVE-2022-4725AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgeryMaven · com.amazonaws:aws-android-sdk-mobile-client · fixed in 2.59.1
- CVE-2022-45347Apache ShardingSphere-Proxy: MySQL authentication bypassMaven · org.apache.shardingsphere:shardingsphere-proxy · fixed in 5.3.0
- CVE-2022-40145Apache Karaf: JDBC JAAS LDAP injectionMaven · org.apache.karaf:apache-karaf · fixed in 4.3.8, 4.4.2
- CVE-2022-25940Denial of Service (DoS)Maven · org.webjars.npm:lite-server
- CVE-2022-4640Mingsoft MCMS Article save cross site scriptingMaven · net.mingsoft:ms-mcms
- CVE-2022-47500Apache Helix: Open redirectMaven · org.apache.helix:helix · fixed in 1.1.0
- CVE-2022-47551Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API.Maven · io.apiman:apiman-manager-api-rest-impl · fixed in 3.0.0.Final
- CVE-2022-46870Apache Zeppelin: Stored XSS in note permissionsMaven · org.apache.zeppelin:zeppelin · fixed in 0.8.2
- CVE-2021-28655Apache Zeppelin: Arbitrary file deletion vulnerabilityMaven · org.apache.zeppelin:zeppelin · fixed in 0.10.0
- CVE-2022-4565Dromara HuTool cn.hutool.core.util.ZipUtil.java resource consumptionMaven · cn.hutool:hutool-core · fixed in 5.8.11
- CVE-2022-32531Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname VerificationMaven · org.apache.bookkeeper:bookkeeper-common · fixed in 4.14.6, 4.15.1
- CVE-2022-4520WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scriptingMaven · org.wso2.carbon.registry:carbon-registry · fixed in 4.8.12
- CVE-2022-4521WSO2 carbon-registry Request Parameter cross site scriptingMaven · org.wso2.carbon.registry:carbon-registry · fixed in 4.8.7
- CVE-2022-34271Apache Atlas: zip path traversal in import functionalityMaven · org.apache.atlas:apache-atlas · fixed in 2.3.0
- CVE-2022-4493scifio ZIP File DefaultSampleFilesService.java downloadAndUnpackResource path traversalMaven · io.scif:scifio · fixed in 0.43.3
- CVE-2022-46364Apache CXF SSRF VulnerabilityMaven · org.apache.cxf:cxf-core · fixed in 3.4.10, 3.5.5
- CVE-2022-46363Apache CXF directory listing / code exfiltrationMaven · org.apache.cxf:cxf-core · fixed in 3.4.10, 3.5.5
- CVE-2022-41915Netty project is an event-driven asynchronous network application framework.Maven · io.netty:netty-codec-http · fixed in 4.1.86.Final
- CVE-2022-45685A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.Maven · org.codehaus.jettison:jettison · fixed in 1.5.2
- CVE-2022-45688A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSMaven · cn.hutool:hutool-json, org.json:json · fixed in 5.8.25, 20230227
- CVE-2022-45689hutool-json v5.8.10 was discovered to contain an out of memory error.Maven · cn.hutool:hutool-json
- CVE-2022-45690A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a DenialMaven · cn.hutool:hutool-json · fixed in 5.8.11
- CVE-2022-45693Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter.Maven · org.codehaus.jettison:jettison · fixed in 1.5.2
- CVE-2022-41881Netty project is an event-driven asynchronous network application framework.Maven · io.netty:netty-codec-haproxy · fixed in 4.1.86.Final
- CVE-2022-46166Spring Boot Admins integrated notifier support allows arbitrary code executionMaven · de.codecentric:spring-boot-admin · fixed in 2.6.10, 2.7.8, 3.0.0-M6