Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-40929XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.Maven · com.xuxueli:xxl-job-core
- CVE-2022-39243NuProcess vulnerable to command-line injection through insertion of NUL character(s)Maven · com.zaxxer:nuprocess · fixed in 2.0.5
- CVE-2022-23463SpEL Injection in Nepxion DiscoveryMaven · com.nepxion:discovery
- CVE-2022-23464Potential Server Side Request Forgery (SSRF) in Nepxion DiscoveryMaven · com.nepxion:discovery
- CVE-2022-36025Incorrect Conversion between Numeric Types in Besu Ethereum ClientMaven · org.hyperledger.besu:evm · fixed in 22.7.1
- CVE-2022-33683Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack Maven · org.apache.pulsar:pulsar-broker, org.apache.pulsar:pulsar-proxy · fixed in 2.7.5, 2.8.4, 2.9.3 and more
- CVE-2022-33682Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attackMaven · org.apache.pulsar:pulsar-broker, org.apache.pulsar:pulsar-proxy · fixed in 2.7.5, 2.8.4, 2.9.3 and more
- CVE-2022-33681Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITMMaven · org.apache.pulsar:pulsar-client · fixed in 2.7.5, 2.8.4, 2.9.3 and more
- CVE-2022-24280Apache Pulsar Proxy target broker address isn't validatedMaven · org.apache.pulsar:pulsar · fixed in 2.7.5, 2.8.3, 2.9.2
- CVE-2022-26112Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function supportMaven · org.apache.pinot:pinot · fixed in 0.11.0
- CVE-2022-36944Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file.Maven · org.scala-lang:scala-library · fixed in 2.13.9
- CVE-2022-40705Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTPMaven · soap:soap
- CVE-2022-38512The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions befMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.translation.web · fixed in 7.4.13.u37, 2.0.58
- CVE-2022-28980Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitraryMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.fragment.renderer.collection.filter.impl · fixed in 7.4.3.5-ga5, 1.0.11
- CVE-2022-28981Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access fileMaven · com.liferay:com.liferay.headless.discovery.web · fixed in 4.0.12
- CVE-2022-28977HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 Maven · com.liferay.portal:com.liferay.util.java, com.liferay.portal:release.dxp.bom +1 · fixed in 7.9.0, 7.0.10.fp101, 7.1.10.fp25 and more
- CVE-2022-38398Server-Side Request Forgery Information Disclosure VulnerabilityMaven · org.apache.xmlgraphics:batik, org.apache.xmlgraphics:batik-bridge · fixed in 1.15
- CVE-2022-38648PDFTranscoder does not block external resourcesMaven · org.apache.xmlgraphics:batik, org.apache.xmlgraphics:batik-bridge · fixed in 1.15
- CVE-2022-40146Jar url should be blocked by DefaultScriptSecurityMaven · org.apache.xmlgraphics:batik · fixed in 1.15
- CVE-2022-28982A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackeMaven · com.liferay:com.liferay.asset.taglib · fixed in 6.1.9
- CVE-2022-28978Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.site.memberships.web · fixed in 7.0.10.fp102, 7.1.10.fp26, 7.2.10.fp15 and more
- CVE-2022-39975The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.35
- CVE-2022-28979Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discoMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.portal.search.web · fixed in 6.0.19
- CVE-2022-31679Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupMaven · org.springframework.data:spring-data-rest-core · fixed in 3.6.7, 3.7.3
- CVE-2022-41255Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it canMaven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41254Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attackerMaven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41253A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-speMaven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41252Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID Maven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41250A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an aMaven · com.meowlomo.jenkins:scm-httpclient
- CVE-2022-41251A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IMaven · org.jenkins-ci.plugins:apprenda