Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-39259Jadx-gui subject to Denial of Service via Swing HTML renderingMaven · io.github.skylot:jadx-plugins-api · fixed in 1.4.5
- CVE-2022-40084OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a passMaven · org.opencrx:opencrx-client · fixed in 5.2.2
- CVE-2022-31684Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests.Maven · io.projectreactor.netty:reactor-netty-http · fixed in 1.0.24
- CVE-2022-42466XSS vulnerability, eg for String properties.Maven · org.apache.isis.core:isis-core · fixed in 2.0.0-M9
- CVE-2022-42467h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.Maven · org.apache.isis.core:isis-core · fixed in 2.0.0-M8
- CVE-2022-43401A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security PluginMaven · org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins:script-security · fixed in 2803.v1a_f77ffcc773, 1184.v85d16b_d851b_3
- CVE-2022-43402A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy PlugiMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2803.v1a_f77ffcc773
- CVE-2022-43403A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_4Maven · org.jenkins-ci.plugins:script-security · fixed in 1184.v85d16b_d851b_3
- CVE-2022-43404A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Maven · org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins:script-security · fixed in 2803.v1a_f77ffcc773, 1184.v85d16b_d851b_3
- CVE-2022-43405A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission Maven · io.jenkins.plugins:pipeline-groovy-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 613.v9c41a_160233f, 588.v576c103a_ff86
- CVE-2022-43406A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with Maven · io.jenkins.plugins:pipeline-groovy-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 613.v9c41a_160233f, 588.v576c103a_ff86
- CVE-2022-43407Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input'Maven · org.jenkins-ci.plugins:pipeline-input-step · fixed in 456.vd8a_957db_5b_e9
- CVE-2022-43408Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proMaven · org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view · fixed in 2.27, 2.24.2
- CVE-2022-43409Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POMaven · org.jenkins-ci.plugins.workflow:workflow-support · fixed in 839.v35e2736cfd5c
- CVE-2022-43410Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling throMaven · org.jenkins-ci.plugins:mercurial · fixed in 1260.vdfb_723cdcc81
- CVE-2022-43411Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhooMaven · org.jenkins-ci.plugins:gitlab-plugin · fixed in 1.5.36
- CVE-2022-43412Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided anMaven · org.jenkins-ci.plugins:generic-webhook-trigger · fixed in 1.84.2
- CVE-2022-43413Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permMaven · org.jenkins-ci.plugins:job-import-plugin · fixed in 3.6
- CVE-2022-43414Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test Maven · org.jenkins-ci.plugins:nunit · fixed in 0.28
- CVE-2022-43415Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:repo · fixed in 1.16.0
- CVE-2022-43416Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invMaven · org.jenkins-ci.plugins:katalon · fixed in 1.0.33
- CVE-2022-43417Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/ReadMaven · org.jenkins-ci.plugins:katalon · fixed in 1.0.33
- CVE-2022-43418A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-spMaven · org.jenkins-ci.plugins:katalon · fixed in 1.0.34
- CVE-2022-43419Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viMaven · org.jenkins-ci.plugins:katalon · fixed in 1.0.33
- CVE-2022-43420Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generatMaven · org.jenkins-ci.plugins:contrast-continuous-application-security · fixed in 3.10
- CVE-2022-43421A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap pMaven · org.jenkins-ci.plugins:tuleap-git-branch-source · fixed in 3.2.5
- CVE-2022-43422Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executMaven · com.compuware.jenkins:compuware-topaz-utilities · fixed in 1.0.9
- CVE-2022-43423Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that doesMaven · com.compuware.jenkins:compuware-scm-downloader · fixed in 2.0.13
- CVE-2022-43424Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can beMaven · com.compuware.jenkins:compuware-xpediter-code-coverage · fixed in 1.0.8
- CVE-2022-43425Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters onMaven · io.jenkins.plugins:custom-checkbox-parameter