Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-34191Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views diMaven · io.jenkins.plugins:cavisson-ns-nd-integration · fixed in 4.8.0.129
- CVE-2022-34190Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact vMaven · eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin
- CVE-2022-34189Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parMaven · org.jenkins-ci.plugins:image-tag-parameter
- CVE-2022-34188Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displayinMaven · org.jenkins-ci.plugins:hidden-parameter · fixed in 0.0.5
- CVE-2022-34187Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters oMaven · aendter.jenkins.plugins:filesystem-list-parameter-plugin
- CVE-2022-34186Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parametMaven · com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter
- CVE-2022-34185Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, Maven · me.leejay.jenkins:date-parameter
- CVE-2022-34184Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameterMaven · org.jenkins-ci.plugins:crx-content-package-deployer
- CVE-2022-34183Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displayinMaven · io.jenkins.plugins:agent-server-parameter
- CVE-2022-34182Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scriptiMaven · org.jenkins-ci.plugins:nested-view · fixed in 1.26
- CVE-2022-34181Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't existMaven · org.jenkins-ci.plugins:xunit · fixed in 3.1.0
- CVE-2022-34180Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it Maven · org.jenkins-ci.plugins:embeddable-build-status · fixed in 2.0.4
- CVE-2022-34179Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG Maven · org.jenkins-ci.plugins:embeddable-build-status · fixed in 2.0.4
- CVE-2022-34178Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restrMaven · org.jenkins-ci.plugins:embeddable-build-status · fixed in 2.0.4
- CVE-2022-34175Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing somMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.356
- CVE-2022-34174In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between logiMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.356, 2.332.4
- CVE-2022-34173In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job displayMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.356
- CVE-2022-34172In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.356, 2.332.4
- CVE-2022-34171In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symboMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.356, 2.346.1, 2.332.4
- CVE-2022-34170In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the featuMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.356, 2.332.4, 2.346.1
- CVE-2022-32549log injection in Sling loggingMaven · org.apache.sling:org.apache.sling.api, org.apache.sling:org.apache.sling.commons.log
- CVE-2022-22980A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expresMaven · org.springframework.data:spring-data-mongodb · fixed in 3.4.1, 3.3.5
- CVE-2022-34298The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."Maven · org.openidentityplatform.openam:openam-core · fixed in 14.6.6
- CVE-2022-34176Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scriptMaven · org.jenkins-ci.plugins:junit · fixed in 1119.1121.vc43d0fc45561
- CVE-2022-34177Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` stepMaven · org.jenkins-ci.plugins:pipeline-input-step · fixed in 449.v77f0e8b
- CVE-2022-22979In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionalMaven · org.springframework.cloud:spring-cloud-function-parent · fixed in 3.2.6
- CVE-2020-28865An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/saveMaven · com.github.kfcfans:powerjob · fixed in 3.3.3
- CVE-2021-41411drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java.Maven · org.drools:drools-core · fixed in 7.60.0.Final
- CVE-2022-31044Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process AutomationMaven · org.rundeck:rundeck · fixed in 4.2.2, 4.3.1
- CVE-2022-33140Improper Neutralization of Command Elements in Shell User Group ProviderMaven · org.apache.nifi.registry:nifi-registry-core, org.apache.nifi:nifi · fixed in 1.16.3