Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-43426Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to oMaven · io.jenkins.plugins:s3explorer
- CVE-2022-43427Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attacMaven · com.compuware.jenkins:compuware-topaz-for-total-test · fixed in 2.4.9
- CVE-2022-43428Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be eMaven · com.compuware.jenkins:compuware-topaz-for-total-test · fixed in 2.4.9
- CVE-2022-43429Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be eMaven · com.compuware.jenkins:compuware-topaz-for-total-test
- CVE-2022-43430Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacMaven · com.compuware.jenkins:compuware-topaz-for-total-test · fixed in 2.4.9
- CVE-2022-43431Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers wiMaven · com.compuware.jenkins:compuware-strobe-measurement · fixed in 1.0.2
- CVE-2022-43432Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content iMaven · org.jenkins-ci.plugins:xframium
- CVE-2022-43433Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worMaven · io.jenkins.plugins:screenrecorder
- CVE-2022-43434Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generaMaven · io.jenkins.plugins:neuvector-vulnerability-scanner · fixed in 1.22
- CVE-2022-43435Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worMaven · org.jenkins-ci.plugins.plugin:fireline
- CVE-2022-39198Apache Dubbo Hession Deserialization Vulnerability Gadgets BypassMaven · com.alibaba:hessian-lite, org.apache.dubbo:dubbo · fixed in 3.2.13, 2.7.18, 3.0.12 and more
- CVE-2022-42112A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.portal.search.web · fixed in 7.2.10.fp19, 7.3.10.u5, 7.4.13.u25 and more
- CVE-2022-42113A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 updatMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.document.library.web · fixed in 7.4.13.u37, 6.0.98
- CVE-2022-42114A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and LiferMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.roles.admin.web · fixed in 7.4.13.u37, 5.0.48
- CVE-2022-42115Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows rMaven · com.liferay:com.liferay.object.web · fixed in 1.0.99
- CVE-2022-42116A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.1Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.frontend.editor.ckeditor.web · fixed in 7.3.10.u6, 7.4.13.u15, 5.0.46
- CVE-2022-42117A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 beforMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.frontend.taglib.clay · fixed in 7.3.10.u6, 7.4.13.u17, 9.1.7
- CVE-2022-24697Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersMaven · org.apache.kylin:kylin-core-common, org.apache.kylin:kylin-server-base +1 · fixed in 4.0.2
- CVE-2022-42889Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaultsMaven · com.guicedee.services:commons-text, org.apache.commons:commons-text · fixed in 1.10.0
- CVE-2022-3171Memory handling vulnerability in ProtocolBuffers Java core and liteMaven · com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-javalite +2 · fixed in 3.21.7, 3.20.3, 3.19.6 and more
- CVE-2022-40664Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcherMaven · org.apache.shiro:shiro-core · fixed in 1.10.0
- CVE-2022-41404An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (Maven · org.ini4j:ini4j
- CVE-2022-41414An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernamMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.portal.bom · fixed in 8.0.0, 7.4.2-ga3
- CVE-2022-41853Remote code execution in HyperSQL DataBaseMaven · org.hsqldb:hsqldb · fixed in 2.7.1
- CVE-2022-42003In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitivMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.12.7.1, 2.13.4.2
- CVE-2022-42004In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.12.7.1, 2.13.4
- CVE-2022-41828In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check thMaven · com.amazon.redshift:redshift-jdbc42 · fixed in 2.1.0.8
- CVE-2022-39248matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionMaven · org.matrix.android:matrix-android-sdk2 · fixed in 1.5.1
- CVE-2022-39246matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessionsMaven · org.matrix.android:matrix-android-sdk2 · fixed in 1.5.1
- CVE-2021-43980Apache Tomcat: Information disclosureMaven · org.apache.tomcat:tomcat · fixed in 8.5.78, 9.0.62, 10.0.20 and more