Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-29002A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-Maven · com.xuxueli:xxl-job
- CVE-2022-29599Commandline class shell injection vulnerabilitiesMaven · org.apache.maven.shared:maven-shared-utils · fixed in 3.3.3
- CVE-2022-31267Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as anMaven · com.gitblit:gitblit · fixed in 1.9.3
- CVE-2022-31268A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-IMaven · com.gitblit:gitblit
- CVE-2022-24434Denial of Service (DoS)Maven · org.webjars.npm:dicer
- CVE-2022-22976Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerabilMaven · org.springframework.security:spring-security-core · fixed in 5.5.7, 5.6.4
- CVE-2022-22978In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigureMaven · org.springframework.security:spring-security-core, org.springframework.security:spring-security-web · fixed in 5.5.7, 5.6.4, 5.4.11
- CVE-2022-1782Cross-site Scripting (XSS) - Generic in erudika/paraMaven · com.erudika:para-core · fixed in 1.45.11
- CVE-2022-30972A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse Maven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2022-30971Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2022-30970Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names inMaven · org.jenkins-ci.plugins:autocomplete-parameter
- CVE-2022-30969A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitMaven · org.jenkins-ci.plugins:autocomplete-parameter
- CVE-2022-30968Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, Maven · org.jenkins-ci.plugins:vboxwrapper
- CVE-2022-30967Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on viewMaven · org.jvnet.hudson.plugins:selection-tasks-plugin
- CVE-2022-30966Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displayMaven · org.jenkins-ci.plugins:random-string-parameter
- CVE-2022-30965Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views dispMaven · org.jenkins-ci.plugins:promoted-builds-simple
- CVE-2022-30964Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying Maven · io.jenkins.plugins:multiselect-parameter · fixed in 1.4
- CVE-2022-30963Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resuMaven · org.jenkins-ci.plugins:jdk_parameter_plugin
- CVE-2022-30962Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameterMaven · org.jenkins-ci.plugins:global-variable-string-parameter
- CVE-2022-30961Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters Maven · org.jenkins-ci.plugins:autocomplete-parameter
- CVE-2022-30960Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying pMaven · org.jenkins-ci.plugins:app-detector · fixed in 1.0.9
- CVE-2022-30959A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-sMaven · org.jenkins-ci.plugins:ssh
- CVE-2022-30958A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specifiMaven · org.jenkins-ci.plugins:ssh
- CVE-2022-30957A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDMaven · org.jenkins-ci.plugins:ssh
- CVE-2022-30956Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scrMaven · org.jenkins-ci.plugins:rundeck · fixed in 3.6.11
- CVE-2022-30955Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permiMaven · org.jenkins-ci.plugins:gitlab-plugin · fixed in 1.5.32
- CVE-2022-30954Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Maven · io.jenkins.blueocean:blueocean-parent · fixed in 1.25.4
- CVE-2022-30953A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attackerMaven · io.jenkins.blueocean:blueocean-parent · fixed in 1.25.4
- CVE-2022-30951Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentiallyMaven · org.jenkins-ci.plugins:windows-slaves · fixed in 1.8.1
- CVE-2022-30950Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability thatMaven · org.jenkins-ci.plugins:windows-slaves · fixed in 1.8.1