Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-34809Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be Maven · net.praqma:rqm-plugin
- CVE-2022-34808Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller wheMaven · org.jenkins-ci.plugins:cisco-spark
- CVE-2022-34807Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller Maven · org.jenkins-ci.plugins:elasticsearch-query
- CVE-2022-34806Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viMaven · org.jenkins-ci.plugins:jigomerge
- CVE-2022-34805Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller wheMaven · org.jenkins-ci.plugins:skype-notifier
- CVE-2022-34804Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuratMaven · org.jenkins-ci.plugins:opsgenie
- CVE-2022-34803Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the JenkMaven · org.jenkins-ci.plugins:opsgenie
- CVE-2022-34802Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration filMaven · org.jenkins-ci.plugins:rocketchatnotifier
- CVE-2022-34801Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentMaven · tools.devnull:build-notifications
- CVE-2022-34800Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller wMaven · tools.devnull:build-notifications
- CVE-2022-34799Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controlMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34798Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers witMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34797A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to aMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34796A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34795Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34794Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to aMaven · org.jenkins-ci.plugins:recipe
- CVE-2022-34793Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:recipe
- CVE-2022-34792A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an atMaven · org.jenkins-ci.plugins:recipe
- CVE-2022-34791Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stMaven · io.jenkins.plugins:validating-email-parameter
- CVE-2022-34790Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scrMaven · org.jenkins-ci.plugins:xfpanel
- CVE-2022-34789A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous mMaven · net.praqma:matrix-reloaded
- CVE-2022-34788Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSSMaven · net.praqma:matrix-reloaded
- CVE-2022-34787Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-siteMaven · hudson.plugins:project-inheritance
- CVE-2022-34786Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-Maven · org.jenkins-ci.plugins:rich-text-publisher-plugin
- CVE-2022-34785Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Maven · org.jenkins-ci.plugins:build-metrics
- CVE-2022-34784Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS)Maven · org.jenkins-ci.plugins:build-metrics
- CVE-2022-34783Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability expMaven · org.jenkins-ci.plugins:plot · fixed in 2.1.11
- CVE-2022-34782An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view theMaven · org.jenkins-ci.plugins:requests · fixed in 2.2.17
- CVE-2022-34781Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect Maven · com.xebialabs.ci:xlrelease-plugin · fixed in 22.0.1
- CVE-2022-34780A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to aMaven · com.xebialabs.ci:xlrelease-plugin · fixed in 22.0.1