Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-31195Path traversal vulnerability in Simple Archive Format package import in DSpaceMaven · org.dspace:dspace-api · fixed in 5.11, 6.4
- CVE-2022-31192Cross Site Scripting possible in DSpace JSPUI "Request a Copy" featureMaven · org.dspace:dspace-jspui · fixed in 5.11, 6.4
- CVE-2022-31191Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete toolsMaven · org.dspace:dspace-jspui · fixed in 5.11, 6.4
- CVE-2022-31194Path traversal vulnerabilities in DSpace JSPUI submission uploadMaven · org.dspace:dspace-jspui · fixed in 5.11, 6.4
- CVE-2022-31193URL Redirection to Untrusted Site in Dspace JSPUIMaven · org.dspace:dspace-jspui · fixed in 5.11, 6.4
- CVE-2022-31189"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitizationMaven · org.dspace:dspace-jspui · fixed in 6.4
- CVE-2022-31190Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUIMaven · org.dspace:dspace-xmlui · fixed in 6.4
- CVE-2022-31183mTLS client verification is skipped in fs2 on Node.jsMaven · co.fs2:fs2-io, co.fs2:fs2-io_2.12 +4 · fixed in 3.2.11
- CVE-2022-2576In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameterMaven · org.eclipse.californium:californium-core · fixed in 2.7.3, 3.6.0
- CVE-2022-36364Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vectorMaven · org.apache.calcite.avatica:avatica-core · fixed in 1.22.0
- CVE-2022-36922Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page,Maven · org.jenkins-ci.plugins:lucene-search · fixed in 387.v938a
- CVE-2022-36921A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:coverity
- CVE-2022-36920A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-sMaven · org.jenkins-ci.plugins:coverity
- CVE-2022-36919A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentiMaven · org.jenkins-ci.plugins:coverity
- CVE-2022-36918Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackerMaven · org.jenkins-ci.plugins:buckminster
- CVE-2022-36917A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a Maven · org.jenkins-ci.plugins:google-cloud-backup
- CVE-2022-36916A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manualMaven · org.jenkins-ci.plugins:google-cloud-backup
- CVE-2022-36915Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attaMaven · org.jenkins-ci.plugins:android-signing
- CVE-2022-36914Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing atMaven · org.jenkins-ci.plugins:files-found-trigger
- CVE-2022-36913Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackersMaven · org.jenkins-ci.plugins:openstack-heat
- CVE-2022-36912A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an aMaven · org.jenkins-ci.plugins:openstack-heat
- CVE-2022-36911A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attackeMaven · org.jenkins-ci.plugins:openstack-heat
- CVE-2022-36910Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackersMaven · org.jenkins-ci.plugins:lucene-search · fixed in 387.v938a
- CVE-2022-36909A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check forMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36908A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the eMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36907A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect tMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36906A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an aMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36905Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of LiMaven · eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin
- CVE-2022-36904Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowingMaven · org.jenkins-ci.plugins:repository-connector
- CVE-2022-36903A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumeraMaven · org.jenkins-ci.plugins:repository-connector