Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-42127The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.48
- CVE-2022-42128The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which aMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.5
- CVE-2022-42129An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and LifMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.5
- CVE-2022-42130The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.5
- CVE-2022-42131Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers.Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.4
- CVE-2022-42132The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix packMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom +1 · fixed in 7.1.10.fp27, 7.2.10.fp17, 7.3.10.u4 and more
- CVE-2022-45379Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vuMaven · org.jenkins-ci.plugins:script-security · fixed in 1190.v65867a_a_47126
- CVE-2022-45380Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resMaven · org.jenkins-ci.plugins:junit · fixed in 1160.vf1f01a_a_ea_b_7f
- CVE-2022-45381Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of AMaven · org.jenkins-ci.plugins:pipeline-utility-steps · fixed in 2.13.2
- CVE-2022-45382Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, rMaven · org.jenkins-ci.plugins:naginator · fixed in 1.18.2
- CVE-2022-45383An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle pMaven · org.jenkins-ci.plugins:support-core · fixed in 1206.1208.v9b_7a_1d48db_0f
- CVE-2022-45384Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the JenkinMaven · org.jenkins-ci.main:reverse-proxy-auth-plugin · fixed in 1.7.4
- CVE-2022-45385A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers tMaven · org.jenkins-ci.plugins:dockerhub-notification · fixed in 2.6.2.1
- CVE-2022-45386Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:violations
- CVE-2022-45387Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in aMaven · org.jenkins-ci.plugins:bart
- CVE-2022-45388Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated Maven · org.jenkins-ci.main:config-rotator
- CVE-2022-45389A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs correspondingMaven · com.cloudbees.jenkins.plugins:xpdev
- CVE-2022-45390A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentiMaven · io.loader:loaderio-jenkins-plugin
- CVE-2022-45391Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hMaven · io.jenkins.plugins:cavisson-ns-nd-integration · fixed in 4.8.0.146
- CVE-2022-45392Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the JenMaven · io.jenkins.plugins:cavisson-ns-nd-integration · fixed in 4.8.0.146
- CVE-2022-45393A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.Maven · org.jenkins-ci.plugins:delete-log-plugin
- CVE-2022-45394A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.Maven · org.jenkins-ci.plugins:delete-log-plugin
- CVE-2022-45395Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.thalesgroup.jenkins-ci.plugins:cccc
- CVE-2022-45396Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.thalesgroup.hudson.plugins:sourcemonitor
- CVE-2022-45397Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attMaven · org.jenkins-ci:update-center2
- CVE-2022-45398A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recordedMaven · org.zeroturnaround:cluster-stats
- CVE-2022-45399A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster StatisMaven · org.zeroturnaround:cluster-stats
- CVE-2022-45400Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jvnet.hudson.plugins:japex
- CVE-2022-45401Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSSMaven · org.jenkins-ci.main:associated-files-plugin
- CVE-2022-42110A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fixMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.announcements.web · fixed in 7.1.10.fp27, 7.2.10.fp17, 6.0.11