Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-34779A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerMaven · com.xebialabs.ci:xlrelease-plugin · fixed in 22.0.1
- CVE-2022-34778Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test Maven · org.jenkins-ci.plugins:testng-plugin · fixed in 555.va0d5f66521e3
- CVE-2022-34777Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resultinMaven · org.jenkins-ci.plugins:gitlab-plugin · fixed in 1.5.35
- CVE-2022-32532Authentication Bypass VulnerabilityMaven · org.apache.shiro:shiro-core · fixed in 1.9.1
- CVE-2022-33879Incomplete fix and new regex DoS in StandardsExtractingContentHandlerMaven · org.apache.tika:tika · fixed in 1.28.4, 2.4.1
- CVE-2022-26477Denial of service in readExternal methodMaven · org.apache.systemds:systemds · fixed in 2.2.2
- CVE-2022-33113Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field underMaven · com.jfinal:jfinal
- CVE-2022-34305XSS in examples web applicationMaven · org.apache.tomcat:tomcat · fixed in 10.1.0-M17, 10.0.22, 9.0.65 and more
- CVE-2022-34213Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the JMaven · org.jenkins-ci.plugins:squashtm-publisher
- CVE-2022-34212A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an Maven · org.jenkins-ci.plugins:vmware-vrealize-orchestrator
- CVE-2022-34211A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP PMaven · org.jenkins-ci.plugins:vmware-vrealize-orchestrator
- CVE-2022-34210A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:threadfix
- CVE-2022-34209A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-sMaven · org.jenkins-ci.plugins:threadfix
- CVE-2022-34208A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an Maven · org.jenkins-ci.plugins:beaker-builder
- CVE-2022-34207A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attackMaven · org.jenkins-ci.plugins:beaker-builder
- CVE-2022-34206A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTMaven · org.jenkins-ci.plugins:jianliao
- CVE-2022-34205A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POSTMaven · org.jenkins-ci.plugins:jianliao
- CVE-2022-34204A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-Maven · com.geteasyqa:easyqa
- CVE-2022-34203A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specifMaven · com.geteasyqa:easyqa
- CVE-2022-34202Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where theMaven · com.geteasyqa:easyqa
- CVE-2022-34201A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to conMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-34200A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect tMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-34199Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller wheMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-34198Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displayMaven · org.jenkins-ci.plugins:stashbranchparameter
- CVE-2022-34197Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displayiMaven · org.jenkins-ci.plugins:sauce-ondemand · fixed in 1.205
- CVE-2022-34196Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying paMaven · io.jenkins.plugins:rest-list-parameter · fixed in 1.6.0
- CVE-2022-34195Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on viMaven · org.jenkins-ci.plugins:repository-connector
- CVE-2022-34194Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parametersMaven · org.jenkins-ci.plugins:readonly-parameters
- CVE-2022-34193Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resuMaven · org.lilicurroad.jenkins:packageversion
- CVE-2022-34192Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, andMaven · org.jenkins-ci.plugins:ontrack