Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-34169Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheetsMaven · xalan:xalan · fixed in 2.7.3
- CVE-2015-8031Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.Maven · org.jvnet.hudson.main:hudson-core · fixed in 3.3.2
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UIMaven · org.apache.spark:spark-parent_2.12 · fixed in 3.2.2
- CVE-2021-34538Apache Hive Security vulnerability in Hive with UDFsMaven · org.apache.hive:hive · fixed in 3.1.3
- CVE-2022-31159Partial Path Traversal in com.amazonaws:aws-java-sdk-s3 Maven · com.amazonaws:aws-java-sdk-s3 · fixed in 1.12.261
- CVE-2022-32065An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary cMaven · com.ruoyi:ruoyi · fixed in 4.7.4
- CVE-2022-31781Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)Maven · org.apache.tapestry:tapestry-core · fixed in 5.8.2
- CVE-2022-30187Azure Storage Library Information Disclosure VulnerabilityMaven · com.azure:azure-storage-blob · fixed in 12.18.0
- CVE-2022-31139No security checking for UnsafeAccess.getInstance() in UnsafeAccessorMaven · io.github.karlatemp:unsafe-accessor · fixed in 1.7.0
- CVE-2022-1245A privilege escalation flaw was found in the token exchange feature of keycloak.Maven · org.keycloak:keycloak-services · fixed in 18.0.0
- CVE-2021-41042In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working Maven · org.eclipse.lyo:lyo-parent · fixed in 5.0.0.Final
- CVE-2022-2191In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByMaven · org.eclipse.jetty:jetty-server · fixed in 10.0.10, 11.0.10
- CVE-2022-2047In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment oMaven · org.eclipse.jetty:jetty-http · fixed in 9.4.47, 10.0.10, 11.0.10
- CVE-2022-2048In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up noMaven · org.eclipse.jetty.http2:http2-server · fixed in 9.4.47, 10.0.10, 11.0.10
- CVE-2015-5298The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that Maven · org.jenkins-ci.plugins:google-login · fixed in 1.2
- CVE-2022-28889Clickjacking in the web consoleMaven · org.apache.druid:druid · fixed in 0.23.0
- CVE-2021-44791Reflected XSS on certain HTTP endpointsMaven · org.apache.druid:druid · fixed in 0.23.0
- CVE-2022-32533Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesMaven · org.apache.portals.jetspeed-2:jetspeed-commons
- CVE-2022-33980Apache Commons Configuration insecure interpolation defaultsMaven · org.apache.commons:commons-configuration2 · fixed in 2.8.0
- CVE-2021-43116An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packMaven · com.alibaba.nacos:nacos-client
- CVE-2022-31943MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.Maven · net.mingsoft:ms-mcms
- CVE-2022-34818Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attMaven · de.einsundeins.jenkins.plugins.failedjobdeactivator:failedjobdeactivator
- CVE-2022-34817A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobMaven · de.einsundeins.jenkins.plugins.failedjobdeactivator:failedjobdeactivator
- CVE-2022-34816Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where Maven · org.jenkins-ci.plugins:hpe-network-virtualization
- CVE-2022-34815A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept peMaven · org.jenkins-ci.plugins:rrod
- CVE-2022-34814Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackMaven · org.jenkins-ci.plugins:rrod
- CVE-2022-34813A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to cMaven · org.jenkins-ci.plugins:xpath-config-viewer
- CVE-2022-34812A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create Maven · org.jenkins-ci.plugins:xpath-config-viewer
- CVE-2022-34811A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to aMaven · org.jenkins-ci.plugins:xpath-config-viewer
- CVE-2022-34810A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentiMaven · net.praqma:rqm-plugin