Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-41931Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-uiMaven · org.xwiki.platform:xwiki-platform-icon-ui · fixed in 13.10.7, 14.4.2
- CVE-2022-41932Creation of new database tables through login form on PostgreSQLMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.8, 14.4.2, 14.6-rc-1
- CVE-2022-41933Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-defaultMaven · org.xwiki.platform:xwiki-platform-security-authentication-default · fixed in 13.10.8, 14.4.3
- CVE-2022-41934Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-uiMaven · org.xwiki.platform:xwiki-platform-menu-ui · fixed in 13.10.8, 14.4.3
- CVE-2022-41935Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-uiMaven · org.xwiki.platform:xwiki-platform-livetable-ui · fixed in 13.10.8, 14.4.3, 14.6-rc-1
- CVE-2022-41946TemporaryFolder on unix-like systems does not limit access to created files in pgjdbcMaven · org.postgresql:postgresql · fixed in 42.2.27, 42.3.8, 42.4.3 and more
- CVE-2022-45462Apache DolphinScheduler prior to 2.0.5 have command execution vulnerabilityMaven · org.apache.dolphinscheduler:dolphinscheduler-alert-plugins · fixed in 2.0.6
- CVE-2022-45868The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allowMaven · com.h2database:h2 · fixed in 2.2.220
- CVE-2022-4116A vulnerability was found in quarkus.Maven · io.quarkus:quarkus-vertx-http-deployment · fixed in 2.14.2.Final, 2.13.5.Final
- CVE-2022-41936Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-serverMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 13.10.8, 14.4.3, 14.6
- CVE-2022-41937Missing Authorization in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-filter-ui · fixed in 13.10.8, 14.4.3, 14.6-rc-1
- CVE-2022-45146An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4.Maven · org.bouncycastle:bc-fips · fixed in 1.0.2.4
- CVE-2022-45470Apache Hama allows XSS and information disclosureMaven · org.apache.hama:hama-core
- CVE-2022-4065cbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversalMaven · org.testng:testng · fixed in 7.5.1, 7.7.0
- CVE-2022-43183XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.Maven · com.xuxueli:xxl-job-core · fixed in 2.4.0
- CVE-2022-45047Apache MINA SSHD: Java unsafe deserialization vulnerabilityMaven · org.apache.sshd:sshd-common, org.apache.sshd:sshd-core · fixed in 2.9.2
- CVE-2022-38666Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validMaven · org.jenkins-ci.main:cavisson-ns-nd-integration
- CVE-2022-40308Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary filesMaven · org.apache.archiva:archiva-common · fixed in 2.2.9
- CVE-2022-40309Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directoriesMaven · org.apache.archiva:archiva-common · fixed in 2.2.9
- CVE-2022-41918Issue with fine-grained access control of indices backing data streamsMaven · org.opensearch.plugin:opensearch-security · fixed in 1.3.7, 2.4.0
- CVE-2022-42111A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.sharing.web · fixed in 7.2.10.fp19, 7.3.10.u4, 3.0.9
- CVE-2022-42118A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fixMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.portal.search.web · fixed in 7.1.10.fp27, 7.2.10.fp15, 6.0.12
- CVE-2022-42119Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module.Maven · com.liferay.commerce:com.liferay.commerce.catalog.web, com.liferay.portal:release.dxp.bom · fixed in 4.0.8, 7.3.10.u8
- CVE-2022-42120A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.fragment.service · fixed in 7.3.10.u4, 7.4.13.u17, 4.0.33
- CVE-2022-42121A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 befoMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.layout.page.template.service · fixed in 7.1.10.fp27, 7.2.10.fp17, 4.0.17
- CVE-2022-42122A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom +1 · fixed in 7.3.10.u4, 7.4.0-ga1, 4.0.3
- CVE-2022-42123A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.19
- CVE-2022-42124ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.5
- CVE-2022-42125Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows atMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.48
- CVE-2022-42126The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.48