Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-36902Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulMaven · com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter
- CVE-2022-36901Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins contrMaven · org.jenkins-ci.plugins:http_request · fixed in 1.16
- CVE-2022-36900Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackMaven · com.compuware.jenkins:compuware-zadviser-api · fixed in 1.0.4
- CVE-2022-36899Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attMaven · com.compuware.jenkins:compuware-ispw-operations · fixed in 1.0.9
- CVE-2022-36898A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enMaven · com.compuware.jenkins:compuware-ispw-operations · fixed in 1.0.9
- CVE-2022-36897A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permissioMaven · com.compuware.jenkins:compuware-xpediter-code-coverage · fixed in 1.0.8
- CVE-2022-36896A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers wMaven · com.compuware.jenkins:compuware-scm-downloader · fixed in 2.0.13
- CVE-2022-36895A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enMaven · com.compuware.jenkins:compuware-topaz-utilities · fixed in 1.0.9
- CVE-2022-36894An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with OverallMaven · org.jenkins-ci.plugins:clif-performance-testing · fixed in 71.v0741865e206f
- CVE-2022-36893Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attacMaven · org.jenkins-ci.plugins:rpmsign-plugin · fixed in 0.5.1
- CVE-2022-36892Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attacMaven · org.jenkins-ci.plugins:rhnpush-plugin · fixed in 0.5.2
- CVE-2022-36891A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but Maven · org.jenkins-ci.plugins:deployer-framework · fixed in 86.v7b_a_4a_55b_f3ec
- CVE-2022-36890Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, Maven · org.jenkins-ci.plugins:deployer-framework · fixed in 86.v7b_a_4a_55b_f3ec
- CVE-2022-36889Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring aMaven · org.jenkins-ci.plugins:deployer-framework · fixed in 86.v7b_a_4a_55b_f3ec
- CVE-2022-36888A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission tMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin · fixed in 355.v3b_38d767a_b_a_8
- CVE-2022-36887A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attacMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 1156.v536a_97b_8d649
- CVE-2022-36886A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackersMaven · org.jenkins-ci.plugins:external-monitor-job · fixed in 192.ve979ca_8b_3ccd
- CVE-2022-36885Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhooMaven · com.coravy.hudson.plugins.github:github · fixed in 1.34.5
- CVE-2022-36884The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs confMaven · org.jenkins-ci.plugins:git · fixed in 4.11.4
- CVE-2022-36883A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured toMaven · org.jenkins-ci.plugins:git · fixed in 4.11.4
- CVE-2022-36882A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configMaven · org.jenkins-ci.plugins:git · fixed in 4.11.4
- CVE-2022-36881Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enablinMaven · org.jenkins-ci.plugins:git-client · fixed in 3.11.1
- CVE-2020-7677Arbitrary Code ExecutionMaven · org.webjars.npm:thenify · fixed in 3.3.1
- CVE-2022-34112An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a righMaven · io.dataease:dataease-plugin-common · fixed in 1.11.2
- CVE-2022-34114Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.Maven · io.dataease:dataease-plugin-common · fixed in 1.11.2
- CVE-2022-34113An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.Maven · io.dataease:dataease-plugin-common · fixed in 1.11.2
- CVE-2022-34115DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.Maven · io.dataease:dataease-plugin-common · fixed in 1.11.2
- CVE-2022-32430An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the applicatioMaven · io.github.talelin:lin-cms-core
- CVE-2022-31160jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelMaven · org.webjars.npm:jquery-ui · fixed in 1.13.2
- CVE-2022-35912In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 confMaven · org.grails:grails-databinding · fixed in 3.3.15, 4.1.1, 5.1.9 and more