Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-33036Apache Hadoop Privilege escalation vulnerabilityMaven · org.apache.hadoop:hadoop-yarn-server-common · fixed in 2.10.2, 3.2.3, 3.3.2
- CVE-2021-40660An issue was discovered in Delight Nashorn Sandbox 0.2.0.Maven · org.javadelight:delight-nashorn-sandbox · fixed in 0.3.1
- CVE-2022-25167Apache Flume vulnerable to a JNDI RCE in JMSSourceMaven · org.apache.flume.flume-ng-sources:flume-jms-source · fixed in 1.10.0
- CVE-2022-31053Signature forgery in BiscuitMaven · com.clever-cloud:biscuit-java · fixed in 2.0.0
- CVE-2021-37404Heap buffer overflow in libhdfs native libraryMaven · org.apache.hadoop:hadoop-common · fixed in 3.3.2, 3.2.3, 2.10.2
- CVE-2022-25845Deserialization of Untrusted DataMaven · com.alibaba:fastjson · fixed in 1.2.83
- CVE-2022-24969bypass of CVE-2021-25640Maven · com.alibaba:dubbo, org.apache.dubbo:dubbo · fixed in 2.6.12, 2.7.15
- CVE-2022-29631Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.htMaven · org.jodd:jodd-http · fixed in 6.2.1
- CVE-2022-23712A Denial of Service flaw was discovered in Elasticsearch.Maven · org.elasticsearch:elasticsearch · fixed in 8.2.1
- CVE-2022-29770XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.Maven · com.xuxueli:xxl-job
- CVE-2022-31023Dev error stack trace leaking into prod in Play FrameworkMaven · com.typesafe.play:play_2.12, com.typesafe.play:play_2.13 · fixed in 2.8.16
- CVE-2022-31018Denial of service binding form from JSON in Play FrameworkMaven · com.typesafe.play:play_2.12, com.typesafe.play:play_2.13 · fixed in 2.8.16
- CVE-2022-29648A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-FoMaven · com.jflyfox:jflyfox_jfinal
- CVE-2022-29647An issue was discovered in MCMS 5.2.7.Maven · net.mingsoft:ms-mcms
- CVE-2022-29258Cross-site Scripting in Filter Stream Converter Application in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-filter-ui · fixed in 12.10.11, 13.4.7, 13.10.3
- CVE-2022-23082CureKit - Path Traversal in isFileOutsideDirMaven · io.whitesource:curekit · fixed in 1.1.4
- CVE-2022-30973Missing fix for CVE-2022-30126 in 1.28.2Maven · org.apache.tika:tika-core · fixed in 1.28.3
- CVE-2022-30506An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP fiMaven · net.mingsoft:ms-mcms
- CVE-2022-30500Jfinal cms 5.1.0 is vulnerable to SQL Injection.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2022-29251Cross-site Scripting in the Flamingo theme managerMaven · org.xwiki.platform:xwiki-platform-flamingo-theme-ui · fixed in 12.10.11, 13.4.7, 13.10.3
- CVE-2022-29252Cross-site Scripting in XWiki Platform Wiki UI Main WikiMaven · org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki · fixed in 12.10.11, 13.4.7, 13.10.3
- CVE-2022-29253Path Traversal in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.10.3
- CVE-2022-29405Apache Archiva Arbitrary user password reset vulnerabilityMaven · org.apache.archiva:archiva · fixed in 2.2.8
- CVE-2021-3597A flaw was found in undertow.Maven · io.undertow:undertow-core · fixed in 2.2.9.Final, 2.0.39.Final
- CVE-2021-3629A flaw was found in Undertow.Maven · io.undertow:undertow-core · fixed in 2.0.40.Final, 2.2.11.Final
- CVE-2021-3717A flaw was found in Wildfly.Maven · org.wildfly.core:wildfly-core-parent · fixed in 17.0
- CVE-2022-29249Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZMaven · io.github.javaezlib:javaez · fixed in 1.7
- CVE-2022-29237Limited Authentication Bypass for Media Files in OpencastMaven · org.opencastproject:opencast-ingest-service-impl · fixed in 10.14, 11.7
- CVE-2022-29567Possible information disclosure inside TreeGrid component with default data providerMaven · com.vaadin:vaadin, com.vaadin:vaadin-grid-flow · fixed in 14.8.10, 22.0.15, 23.0.9
- CVE-2022-1848Business Logic Errors in erudika/paraMaven · com.erudika:para-core · fixed in 1.46.0