Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-3690A flaw was found in Undertow.Maven · io.undertow:undertow-core · fixed in 2.0.40, 2.2.10
- CVE-2022-37223JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2022-37199JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2019-25075HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbMaven · io.gravitee.apim:gravitee-api-management · fixed in 1.25.3
- CVE-2022-35278HTML Injection in ActiveMQ Artemis Web ConsoleMaven · org.apache.activemq:artemis-server · fixed in 2.24.0
- CVE-2021-3513A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled.Maven · org.keycloak:keycloak-parent · fixed in 13.0.0
- CVE-2022-34916Improper Input Validation (JNDI Injection) in JMSMessageConsumerMaven · org.apache.flume.flume-ng-sources:flume-jms-source · fixed in 1.10.1
- CVE-2022-36157XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low PMaven · com.xuxueli:xxl-job · fixed in 2.4.0
- CVE-2022-37422Payara through 5.2022.2 allows directory traversal without authentication.Maven · fish.payara.api:payara-bom · fixed in 5.2022.3
- CVE-2022-36599Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.Maven · net.mingsoft:ms-mcms
- CVE-2022-36272Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.Maven · net.mingsoft:ms-mcms
- CVE-2022-38216An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox producMaven · com.mapbox.mapboxsdk:mapbox-android-core · fixed in 10.6.1
- CVE-2020-23622An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALMaven · org.fourthline.cling:cling-core
- CVE-2022-36007Partial Path Traversal in com.github.jlangch:veniceMaven · com.github.jlangch:venice · fixed in 1.10.17
- CVE-2022-35980OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive InformationMaven · org.opensearch.plugin:opensearch-security · fixed in 2.2.0.0
- CVE-2022-37423Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.lMaven · org.neo4j.procedure:apoc · fixed in 4.4.0.8, 4.3.0.7
- CVE-2022-2390Mutable pending intent in Google Play services SDKMaven · com.google.android.gms:play-services-basement · fixed in 18.0.2
- CVE-2022-38180In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some casesMaven · io.ktor:ktor · fixed in 2.1.0
- CVE-2022-38179JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attackMaven · io.ktor:ktor · fixed in 2.1.0
- CVE-2022-35697AEM File Upload Security Issue leading to RXSSMaven · com.adobe.cq:core.wcm.components.core · fixed in 2.20.8
- CVE-2022-2668An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS Maven · org.keycloak:keycloak-parent · fixed in 19.0.2
- CVE-2022-2053When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit imMaven · io.undertow:undertow-core · fixed in 2.2.19.Final, 2.3.0.Alpha2
- CVE-2022-25168Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTarMaven · org.apache.hadoop:hadoop-common · fixed in 2.10.2, 3.2.4, 3.3.3
- CVE-2022-34158User Group Privilege EscalationMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.3
- CVE-2022-28732Apache JSPWiki Cross-site scripting vulnerability on WeblogPluginMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.3
- CVE-2022-28731Apache JSPWiki CSRF in UserPreferences.jspMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.3
- CVE-2022-28730Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jspMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.3
- CVE-2022-27166XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2Maven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.3
- CVE-2022-31197SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbcMaven · org.postgresql:postgresql · fixed in 42.2.26, 42.4.1, 42.3.7
- CVE-2022-25867NULL Pointer DereferenceMaven · io.socket:socket.io-client · fixed in 2.0.1