Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-45136Apache Jena SDB allows arbitrary deserialisation via JDBCMaven · org.apache.jena:jena-sdb
- CVE-2022-45378Apache SOAP allows unauthenticated users to potentially invoke arbitrary codeMaven · soap:soap
- CVE-2022-3510Parsing issue in protobuf message-type extensionMaven · com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-javalite · fixed in 3.16.3, 3.19.6, 3.20.3 and more
- CVE-2022-41854Stack Overflow in SnakeyamlMaven · org.yaml:snakeyaml · fixed in 1.32
- CVE-2022-3952ManyDesigns Portofino WarFileLauncher.java createTempDir temp fileMaven · com.manydesigns:portofino · fixed in 5.3.3
- CVE-2022-36022Some Deeplearning4J packages use unclaimed s3 bucket in tests and examplesMaven · org.deeplearning4j:dl4j-examples, org.deeplearning4j:platform-tests
- CVE-2022-45129Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than Maven · fish.payara.distributions:payara · fixed in 6.2022.2, 5.2022.5
- CVE-2022-39368Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of recordsMaven · org.eclipse.californium:scandium · fixed in 3.7.0, 2.7.4
- CVE-2022-44244An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.Maven · io.github.talelin:lin-cms-core
- CVE-2022-37865Apache Ivy allows creating/overwriting any file on the systemMaven · org.apache.ivy:ivy · fixed in 2.5.1
- CVE-2022-37866Apache Ivy allows path traversal in the presence of a malicious repositoryMaven · org.apache.ivy:ivy · fixed in 2.5.1
- CVE-2022-42920Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingMaven · org.apache.bcel:bcel · fixed in 6.6.0
- CVE-2022-39387XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication Maven · org.xwiki.contrib.oidc:oidc-authenticator · fixed in 1.29.1
- CVE-2022-32287Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archivesMaven · org.apache.uima:uimaj-core · fixed in 3.3.1
- CVE-2022-43670XSS in Sling CMS Reference App Taxonomy PathMaven · org.apache.sling:org.apache.sling.cms · fixed in 1.1.2
- CVE-2022-3509Parsing issue in protobuf textformatMaven · com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-javalite · fixed in 3.16.3, 3.19.6, 3.20.3 and more
- CVE-2022-31777Apache Spark XSS vulnerability in log viewer UI JavascriptMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 +3 · fixed in 3.2.2, 3.3.1
- CVE-2022-34662Apache DolphinScheduler prior to 3.0.0 allows path traversalMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.0.0
- CVE-2022-42252Apache Tomcat request smuggling via malformed content-lengthMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 8.5.83, 9.0.68, 10.0.27 and more
- CVE-2022-31690Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escMaven · org.springframework.security:spring-security-oauth2-client · fixed in 5.7.5, 5.6.9
- CVE-2022-31692Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includMaven · org.springframework.security:spring-security-core · fixed in 5.7.5, 5.6.9
- CVE-2022-26884Apache DolphinScheduler exposes files without authenticationMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 2.0.6
- CVE-2022-39944The Apache Linkis JDBC EngineConn module has a RCE VulnerabilityMaven · org.apache.linkis:linkis · fixed in 1.3.0
- CVE-2022-42468Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSourceMaven · org.apache.flume.flume-ng-sources:flume-jms-source · fixed in 1.11.0
- CVE-2022-43766Apache IoTDB prior to 0.13.3 allows DoSMaven · org.apache.iotdb:flink-tsfile-connector, org.apache.iotdb:iotdb-server +1 · fixed in 0.13.3
- CVE-2022-34870Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web applicationMaven · org.apache.geode:geode-core · fixed in 1.15.1
- CVE-2022-39312Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization VulnerabilityMaven · io.dataease:dataease-plugin-common · fixed in 1.15.2
- CVE-2022-41704Apache Batik prior to 1.16 allows RCE when loading untrusted SVG inputMaven · org.apache.xmlgraphics:batik · fixed in 1.16
- CVE-2022-42890Apache Batik prior to 1.16 allows RCE via scriptingMaven · org.apache.xmlgraphics:batik, org.apache.xmlgraphics:batik-bridge · fixed in 1.16
- CVE-2021-42010CRLF log injectionMaven · org.apache.heron:heron-api · fixed in 0.20.5-incubating