Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-4375Mingsoft MCMS list sql injectionMaven · net.mingsoft:ms-mcms · fixed in 5.2.10
- CVE-2022-23496A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa Maven · nl.basjes.parse.useragent:yauaa, nl.basjes.parse.useragent:yauaa-beam +10 · fixed in 7.9.0
- CVE-2022-4348y_project RuoYi-Cloud JSON cross site scriptingMaven · com.ruoyi:ruoyi-common
- CVE-2022-4350Mingsoft MCMS search.do cross site scriptingMaven · net.mingsoft:ms-mcms
- CVE-2022-46682Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:plot · fixed in 2.1.12
- CVE-2022-46683Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing Maven · org.jenkins-ci.plugins:google-login · fixed in 1.7
- CVE-2022-46684Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTMLMaven · com.checkmarx.jenkins:checkmarx · fixed in 2022.4.3
- CVE-2022-46685In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentialMaven · org.jenkins-ci.plugins:gitea · fixed in 1.4.5
- CVE-2022-46686Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Maven · io.jenkins.plugins:custom-build-properties · fixed in 2.82.v16d5b
- CVE-2022-46687Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored crMaven · io.jenkins.plugins:spring-config · fixed in 2.0.1
- CVE-2022-46688A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have JenkMaven · org.jenkins-ci.plugins:sonar-gerrit · fixed in 378.vf4646d4df087
- CVE-2022-4147Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed.Maven · io.quarkus:quarkus-vertx-http · fixed in 2.14.2.Final, 2.13.5.Final
- CVE-2022-43484TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable Maven · org.terasoluna.gfw:terasoluna-gfw-common · fixed in 1.0.1.RELEASE
- CVE-2021-37533Apache Commons Net's FTP client trusts the host from PASV response by defaultMaven · commons-net:commons-net · fixed in 3.9.0
- CVE-2022-46366Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputMaven · org.apache.tapestry:tapestry-core · fixed in 5.0.1
- CVE-2022-1471Remote Code execution in SnakeYAMLMaven · org.yaml:snakeyaml · fixed in 2.0
- CVE-2022-44262ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).Maven · org.ff4j:ff4j-core · fixed in 1.9
- CVE-2022-21126Creation of Temporary File in Directory with Insecure PermissionsMaven · com.github.samtools:htsjdk · fixed in 3.0.1
- CVE-2022-41965Opencast Authenticated OpenRedirect VulnerabilityMaven · org.opencastproject:opencast-common · fixed in 12.5
- CVE-2022-45921FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request.Maven · io.fusionauth:fusionauth-java-client · fixed in 1.41.3
- CVE-2022-41954Temporary File Information Disclosure VulnerabilityMaven · net.sf.mpxj:mpxj · fixed in 10.14.1
- CVE-2022-45206Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.Maven · org.jeecgframework.boot:jeecg-module-system · fixed in 3.4.4
- CVE-2022-45207Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.Maven · org.jeecgframework.boot:jeecg-module-system · fixed in 3.4.4
- CVE-2022-45208Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.Maven · org.jeecgframework.boot:jeecg-module-system · fixed in 3.4.4
- CVE-2022-45210Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.Maven · org.jeecgframework.boot:jeecg-module-system · fixed in 3.4.4
- CVE-2022-26885Apache DolphinScheduler config file read by task riskMaven · org.apache.dolphinscheduler:dolphinscheduler-common · fixed in 2.0.6
- CVE-2022-41927XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tagsMaven · org.xwiki.platform:xwiki-platform-tag-ui · fixed in 13.10.7, 14.4.1
- CVE-2022-41928XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xmlMaven · org.xwiki.platform:xwiki-platform-attachment-ui · fixed in 13.10.7, 14.4.2
- CVE-2022-41929Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcoreMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.7, 14.4.2
- CVE-2022-41930org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable usersMaven · org.xwiki.platform:xwiki-platform-user-profile-ui · fixed in 13.10.7, 14.4.2