Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-30949Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the JenkinsMaven · org.jenkins-ci.plugins:git, org.jenkins-ci.plugins:mercurial +1 · fixed in 4.11.2, 2.16.1, 1.14.1
- CVE-2022-30948Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the JenkMaven · org.jenkins-ci.plugins:mercurial · fixed in 2.16.1
- CVE-2022-30947Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins Maven · org.jenkins-ci.plugins:git, org.jenkins-ci.plugins:mercurial +1 · fixed in 4.11.2, 2.16.1, 1.15.0
- CVE-2022-30946A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to haMaven · org.jenkins-ci.plugins:script-security · fixed in 1172.v35f6a
- CVE-2022-30945Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and JenkMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2692.v76b
- CVE-2022-26650Apache ShenYu (incubating) Regular expression denial of serviceMaven · org.apache.shenyu:shenyu, org.apache.shenyu:shenyu-bootstrap · fixed in 2.4.3
- CVE-2022-30952Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with Maven · io.jenkins.blueocean:blueocean-pipeline-scm-api · fixed in 1.25.4
- CVE-2021-23267Improper Control of Dynamically-Managed Code Resources in Crafter StudioMaven · org.craftercms:crafter-studio · fixed in 3.1.18
- CVE-2021-23266Improper Output Neutralization for Logs in Crafter StudioMaven · org.craftercms:craftercms · fixed in 3.1.18
- CVE-2021-23265Improper Privilege Management in Crafter StudioMaven · org.craftercms:craftercms · fixed in 3.1.18
- CVE-2022-30126Apache Tika Regular Expression Denial of Service in Standards ExtractorMaven · org.apache.tika:tika-core · fixed in 1.28.2, 2.4.0
- CVE-2022-25169Apache Tika BPGParser Memory Usage DoSMaven · org.apache.tika:tika · fixed in 1.28.2, 2.4.0
- CVE-2022-25762Response mix-up with WebSocket concurrent send and closeMaven · org.apache.tomcat:tomcat · fixed in 8.5.75, 9.0.20
- CVE-2022-22971In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vuMaven · org.springframework:spring-messaging · fixed in 5.3.20, 5.2.22.RELEASE
- CVE-2022-22970In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable tMaven · org.springframework:spring-beans · fixed in 5.2.22.RELEASE, 5.3.20
- CVE-2022-29885EncryptInterceptor does not provide complete protection on insecure networksMaven · org.apache.tomcat:tomcat · fixed in 10.1.0-M15, 10.0.21, 9.0.63 and more
- CVE-2021-23792XML External Entity (XXE) InjectionMaven · com.twelvemonkeys.imageio:imageio-metadata · fixed in 3.7.1
- CVE-2022-24823Local Information Disclosure Vulnerability in io.netty:netty-codec-httpMaven · io.netty:netty-codec-http · fixed in 4.1.77.Final
- CVE-2022-29161Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-crypto · fixed in 13.10.6, 14.3.1
- CVE-2022-28890Processing external DTDsMaven · org.apache.jena:jena · fixed in 4.5.0
- CVE-2022-28111MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the ordeMaven · com.github.pagehelper:pagehelper · fixed in 5.3.1
- CVE-2021-22573Incorrect signature verification on Google-oauth-java-clientMaven · com.google.oauth-client:google-oauth-client · fixed in 1.33.3
- CVE-2022-24897Arbitrary filesystem write access from VelocityMaven · org.xwiki.commons:xwiki-commons-velocity · fixed in 12.6.7, 12.10.3
- CVE-2021-40822GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.Maven · org.geoserver:gs-main
- CVE-2022-25645Prototype PollutionMaven · org.webjars.npm:dset · fixed in 3.1.2
- CVE-2022-25767Remote Code ExecutionMaven · com.bstek.ureport:ureport2-console
- CVE-2022-25647Deserialization of Untrusted DataMaven · com.google.code.gson:gson · fixed in 2.8.9
- CVE-2022-25842Arbitrary File Write via Archive Extraction (Zip Slip)Maven · com.alibaba.oneagent:one-java-agent-plugin · fixed in 0.0.2
- CVE-2022-29265Improper Restriction of XML External Entity References in Multiple ComponentsMaven · org.apache.nifi:nifi · fixed in 1.16.1
- CVE-2022-24898Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xmlMaven · org.xwiki.commons:xwiki-commons-xml · fixed in 12.10.10, 13.4.4, 13.8-rc-1