Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-38749DoS in SnakeYAMLMaven · be.cylab:snakeyaml, com.alipay.sofa.acts:acts-common-util +5 · fixed in 1.31
- CVE-2022-38750DoS in SnakeYAMLMaven · org.yaml:snakeyaml · fixed in 1.31
- CVE-2022-38751DoS in SnakeYAMLMaven · org.yaml:snakeyaml · fixed in 1.31
- CVE-2022-38752DoS in SnakeYAMLMaven · org.yaml:snakeyaml · fixed in 1.32
- CVE-2022-2256A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7.Maven · org.keycloak:keycloak-parent · fixed in 19.0.2
- CVE-2022-37435Apache ShenYu Admin Improper Privilege ManagementMaven · org.apache.shenyu:shenyu-common · fixed in 2.5.0
- CVE-2022-2466It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.Maven · io.quarkus:quarkus-core-parent · fixed in 2.10.4
- CVE-2022-37023Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11Maven · org.apache.geode:geode-core · fixed in 1.15.0
- CVE-2022-37022Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11Maven · org.apache.geode:geode-core · fixed in 1.15.0
- CVE-2022-37021Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.Maven · org.apache.geode:geode-core · fixed in 1.12.16, 1.13.5, 1.14.1
- CVE-2022-25857Denial of Service (DoS)Maven · org.yaml:snakeyaml · fixed in 1.31
- CVE-2022-36033jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabledMaven · org.jsoup:jsoup · fixed in 1.15.3
- CVE-2022-0084A flaw was found in XNIO, specifically in the notifyReadClosed method.Maven · org.jboss.xnio:xnio-all
- CVE-2022-0225A flaw was found in Keycloak.Maven · org.keycloak:keycloak-core · fixed in 20.0.0
- CVE-2021-3632A flaw was found in Keycloak.Maven · org.keycloak:keycloak-core · fixed in 15.1.0
- CVE-2021-3644A flaw was found in wildfly-core in all versions.Maven · org.wildfly.core:wildfly-server · fixed in 16.0.1.Final, 17.0.0.Beta3
- CVE-2021-3754A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user.Maven · org.keycloak:keycloak-services · fixed in 24.0.1
- CVE-2021-3856ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader.Maven · org.keycloak:keycloak-core · fixed in 15.1.0
- CVE-2021-3859A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.Maven · io.undertow:undertow-core · fixed in 2.2.15
- CVE-2022-36537ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent Maven · org.zkoss.zk:zk · fixed in 8.6.4.2, 9.0.1.3, 9.5.1.4 and more
- CVE-2021-3914It was found that the smallrye health metrics UI component did not properly sanitize some user inputs.Maven · io.smallrye:smallrye-health-ui · fixed in 3.1.2
- CVE-2022-36527Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field unMaven · com.jflyfox:jflyfox_jfinal
- CVE-2021-25642Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity schedulerMaven · org.apache.hadoop:hadoop-yarn-server · fixed in 2.10.2, 3.2.4, 3.3.4
- CVE-2021-4040A flaw was found in AMQ Broker.Maven · org.apache.activemq:artemis-core-client · fixed in 2.19.1
- CVE-2021-4178A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.Maven · io.fabric8:kubernetes-client · fixed in 5.0.3, 5.1.2, 5.3.2 and more
- CVE-2022-38665Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins coMaven · org.jenkins-ci.plugins:collabnet · fixed in 2.0.9
- CVE-2022-38664Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History pagMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 1166.vc9f255f45b
- CVE-2022-38663Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the GitMaven · org.jenkins-ci.plugins:git · fixed in 4.11.5
- CVE-2020-35509A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0.Maven · org.keycloak:keycloak-core · fixed in 14.0.0
- CVE-2021-3827A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed.Maven · org.keycloak:keycloak-saml-core · fixed in 18.0.0