Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-40151Stack Buffer Overflow in xstreamMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.20
- CVE-2022-40149Stack Buffer Overflow in JettisonMaven · org.codehaus.jettison:jettison · fixed in 1.5.1
- CVE-2022-40150Stack Buffer Overflow in JettisonMaven · org.codehaus.jettison:jettison · fixed in 1.5.2
- CVE-2022-37724Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all Maven · wonder:wonder
- CVE-2022-40635Improper Control of Dynamically-Managed Code Resources in Crafter StudioMaven · org.craftercms:craftercms · fixed in 3.1.23
- CVE-2022-40634Improper Control of Dynamically-Managed Code Resources in Crafter StudioMaven · org.craftercms:crafter-studio · fixed in 3.1.23
- CVE-2022-1278A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.Maven · org.wildfly.bom:wildfly · fixed in 27.0.0.Beta1
- CVE-2022-37734graphql-java before19.0 is vulnerable to Denial of Service.Maven · com.graphql-java:graphql-java · fixed in 17.4, 18.3
- CVE-2022-37767Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.Maven · io.pebbletemplates:pebble
- CVE-2022-26049Arbitrary File Write via Archive Extraction (Zip Slip)Maven · com.diffplug.gradle:goomph · fixed in 3.37.2
- CVE-2022-39135Apache Calcite: potential XEE attacksMaven · org.apache.calcite:calcite-core · fixed in 1.32.0
- CVE-2022-36100XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval InjectionMaven · org.xwiki.platform.applications:xwiki-application-tag, org.xwiki.platform:xwiki-platform-tag-ui · fixed in 13.10.6, 14.4
- CVE-2022-36098XWiki Platform Mentions UI vulnerable to Cross-site ScriptingMaven · org.xwiki.platform:xwiki-platform-mentions-ui · fixed in 13.10.6, 14.4
- CVE-2022-36099XWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityMaven · org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki · fixed in 13.10.6, 14.4
- CVE-2022-36097XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formMaven · org.xwiki.platform:xwiki-platform-attachment-ui · fixed in 14.4-rc-1
- CVE-2022-36096XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listMaven · org.xwiki.platform:xwiki-platform-index-ui · fixed in 13.10.6, 14.3
- CVE-2022-36095XWiki Cross-Site Request Forgery (CSRF) for actions on tagsMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 13.10.5, 14.3
- CVE-2022-36094XWiki Platform Web Parent POM vulnerable to XSS in the attachment historyMaven · org.xwiki.platform:xwiki-platform-web · fixed in 13.10.6, 14.3-rc-1
- CVE-2022-36093XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution WizardMaven · org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-web-templates · fixed in 13.10.5, 14.3-rc-1
- CVE-2022-36092XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login ActionMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.4, 14.2
- CVE-2022-36091XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized ActorMaven · org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.2, 13.10.4
- CVE-2022-36090org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive usersMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.5, 14.3-rc-1
- CVE-2022-28220STARTTLS command injection in Apache JAMESMaven · org.apache.james:james-server · fixed in 3.6.3, 3.7.1
- CVE-2022-25914Remote Code Execution (RCE)Maven · com.google.cloud.tools:jib-core · fixed in 0.22.0
- CVE-2022-25897Denial of Service (DoS)Maven · org.eclipse.milo:sdk-server · fixed in 0.6.8
- CVE-2022-31166XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groupsMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.4, 14.2-rc-1
- CVE-2022-31167XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same referenceMaven · org.xwiki.platform:xwiki-platform-security · fixed in 12.10.11, 13.4.6, 13.10.1
- CVE-2022-36663Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.Maven · org.gluu:oxauth-common · fixed in 4.4.1
- CVE-2022-38370No authorization of DatabaseConnectController in grafana-connector. Maven · org.apache.iotdb:iotdb-grafana-connector · fixed in 0.13.1
- CVE-2022-38369Login check vulnerability by session IdMaven · org.apache.iotdb:iotdb-server · fixed in 0.13.1