Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-24891Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration fileMaven · org.owasp.esapi:esapi · fixed in 2.3.0.0
- CVE-2022-1466Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform.Maven · org.keycloak:keycloak-core · fixed in 17.0.1
- CVE-2022-24881Command Injection in Ballcat CodegenMaven · com.hccake:ballcat-codegen · fixed in 1.0.0.beta.2
- CVE-2022-26596Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, aMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.journal.content.web · fixed in 7.0.10.fp94, 7.1.10.fp19, 7.2.10.fp8 and more
- CVE-2022-26597Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.layout.seo.web · fixed in 7.3.10.fp3, 2.0.4
- CVE-2022-29546HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability.Maven · net.sourceforge.htmlunit:neko-htmlunit · fixed in 2.61.0
- CVE-2022-23457Path Traversal in ESAPIMaven · org.owasp.esapi:esapi · fixed in 2.3.0.0
- CVE-2022-27340MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do.Maven · net.mingsoft:ms-mcms
- CVE-2022-29577OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input.Maven · org.owasp.antisamy:antisamy · fixed in 1.6.7
- CVE-2022-28367OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input.Maven · org.owasp.antisamy:antisamy · fixed in 1.6.6
- CVE-2022-28366Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory Maven · net.sourceforge.htmlunit:neko-htmlunit · fixed in 2.27
- CVE-2022-22969<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-ServicMaven · org.springframework.security.oauth:spring-security-oauth2 · fixed in 2.5.2.RELEASE, 2.4.2.RELEASE
- CVE-2022-28820Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code ExecutionMaven · com.adobe.acs:acs-aem-commons · fixed in 5.2.0
- CVE-2022-0272Improper Restriction of XML External Entity Reference in detekt/detektMaven · io.gitlab.arturbosch.detekt:detekt-core · fixed in 1.20.0
- CVE-2022-26595Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom +2 · fixed in 7.7.9, 7.2.10.fp13, 7.3.10.fp2 and more
- CVE-2022-26593Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.asset.taglib · fixed in 7.3.10.fp3, 6.1.0
- CVE-2022-28108Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/fMaven · org.seleniumhq.selenium:selenium-grid, org.seleniumhq.selenium:selenium-server · fixed in 4.0.0-alpha-7
- CVE-2021-3503A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.Maven · org.wildfly:wildfly-metrics · fixed in 23.0.1.Final
- CVE-2022-26594Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow rMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.dynamic.data.mapping.form.field.type · fixed in 7.3.10.fp3, 6.0.11
- CVE-2022-22968In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBindMaven · org.springframework:spring-context · fixed in 5.3.19, 5.2.21.RELEASE
- CVE-2022-24847Improper Input Validation in GeoServerMaven · org.geoserver:gs-main · fixed in 2.20.4, 2.19.6
- CVE-2022-24816Improper Control of Generation of Code in jai-extMaven · it.geosolutions.jaiext.jiffle:jt-jiffle, it.geosolutions.jaiext.jiffle:jt-jiffle-language · fixed in 1.1.22
- CVE-2022-29052Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controMaven · org.jenkins-ci.plugins:google-compute-engine · fixed in 4.3.9
- CVE-2022-29051Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an Maven · org.jenkins-ci.plugins:publish-over-ftp · fixed in 1.17
- CVE-2022-29050A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP Maven · org.jenkins-ci.plugins:publish-over-ftp · fixed in 1.17
- CVE-2022-29048A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attackerMaven · org.jenkins-ci.plugins:subversion · fixed in 2.15.4
- CVE-2022-29047Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requeMaven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 2.21.3, 566.vd0a
- CVE-2022-29046Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on viewsMaven · org.jenkins-ci.plugins:subversion · fixed in 2.15.4
- CVE-2022-29044Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views diMaven · org.jenkins-ci.plugins:nodelabelparameter · fixed in 1.10.3.1
- CVE-2022-29043Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displayingMaven · org.jenkins-ci.plugins:mask-passwords · fixed in 3.1