Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-29042Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameterMaven · org.jenkins-ci.plugins:jobgenerator
- CVE-2022-29041Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameterMaven · org.jenkins-ci.plugins:jira · fixed in 3.7.1, 3.6.1
- CVE-2022-29040Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, rMaven · org.jenkins-ci.tools:git-parameter · fixed in 0.9.16
- CVE-2022-29039Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displMaven · com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger · fixed in 2.35.3
- CVE-2022-29038Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameteMaven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-29037Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters,Maven · org.jenkins-ci.plugins:cvs · fixed in 2.19.1
- CVE-2021-31805Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.Maven · org.apache.struts:struts2-core · fixed in 2.5.30
- CVE-2022-29036Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does nMaven · org.jenkins-ci.plugins:credentials · fixed in 2.6.1.1, 1074.1076.v39c30cecb_0e2, 1087.1089.v2f1b_9a_b_040e4
- CVE-2022-29045Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parMaven · org.jenkins-ci.plugins:promoted-builds · fixed in 3.10.1, 876.v99d29788b
- CVE-2022-29049Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, Maven · org.jenkins-ci.plugins:promoted-builds · fixed in 3.10.1, 876.v99d29788b
- CVE-2022-24839Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)Maven · org.nokogiri:nekohtml · fixed in 1.9.22.noko2
- CVE-2022-24827SQL Injection in elide-datastore-aggregationMaven · com.yahoo.elide:elide-datastore-aggregation · fixed in 6.1.4
- CVE-2022-24820Unauthenticated user can list hidden document from multiple velocity templatesMaven · org.xwiki.platform:xwiki-platform-web · fixed in 12.10.11, 13.4.4, 13.9
- CVE-2022-24819Unauthenticated user can retrieve the list of users through uorgsuggest.vmMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 12.10.11, 13.4.4, 13.9
- CVE-2022-24821Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinxMaven · org.xwiki.platform:xwiki-platform-skin-skinx · fixed in 13.10, 12.10.11, 13.4.6
- CVE-2022-26612Arbitrary file write in FileUtil#unpackEntries on WindowsMaven · org.apache.hadoop:hadoop-common · fixed in 3.2.3, 2.10.2, 3.3.3
- CVE-2022-26850Insufficiently protected credentialsMaven · org.apache.nifi:nifi-single-user-utils · fixed in 1.16
- CVE-2022-23974Pinot segment push endpoint has a vulnerability in unprotected environmentsMaven · org.apache.pinot:pinot · fixed in 0.10.0
- CVE-2022-26585Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.Maven · net.mingsoft:ms-mcms
- CVE-2021-44138There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to readMaven · com.caucho:resin
- CVE-2021-3461A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity providerMaven · org.keycloak:keycloak-parent · fixed in 14.0.0
- CVE-2022-22950n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expMaven · org.springframework:spring-expression · fixed in 5.3.17, 5.2.20.RELEASE
- CVE-2022-22965A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven · org.springframework.boot:spring-boot-starter-web, org.springframework.boot:spring-boot-starter-webflux +3 · fixed in 2.5.12, 2.6.6, 5.2.20.RELEASE and more
- CVE-2022-22963In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toMaven · org.springframework.cloud:spring-cloud-function-context · fixed in 3.2.3, 3.1.7
- CVE-2021-43142An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.Maven · com.wutka:jox
- CVE-2022-27772spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking.Maven · org.springframework.boot:spring-boot · fixed in 2.2.11.RELEASE
- CVE-2022-25598Apache DolphinScheduler user registration is vulnerable to ReDoS attacksMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 2.0.5
- CVE-2022-28160Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controlleMaven · org.jenkins-ci.plugins:selected-tests-executor
- CVE-2022-28159Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in Maven · org.jenkins-ci.plugins:selected-tests-executor
- CVE-2022-28158A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enuMaven · com.surenpi.jenkins:phoenix-autotest