Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-27217Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller wheMaven · com.vmware.vcac:vmware-vrealize-codestream
- CVE-2022-27216Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins contrMaven · org.jenkins-ci.plugins:dbcharts
- CVE-2022-27215A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to anMaven · org.jenkins-ci.plugins:release-helper
- CVE-2022-27214A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacMaven · org.jenkins-ci.plugins:release-helper
- CVE-2022-27213Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values iMaven · io.jenkins.plugins:environment-dashboard
- CVE-2022-27212Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulMaven · org.jenkins-ci.plugins:list-git-branches-parameter
- CVE-2022-27211A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27210A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to conneMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27209A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27208Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on theMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27207Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' pagMaven · org.jenkins-ci.plugins:global-build-stats
- CVE-2022-27206Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the JenkiMaven · org.jenkins-ci.plugins:gitlab-oauth · fixed in 1.14
- CVE-2022-27205A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read perMaven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-27204A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to coMaven · org.jenkins-ci.plugins:extended-choice-parameter · fixed in 356.va_90a_94ca_62ec
- CVE-2022-27203Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from Maven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-27202Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parametMaven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-27201Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no Maven · org.jenkins-ci.plugins:semantic-versioning-plugin · fixed in 1.14
- CVE-2022-27200Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulMaven · io.jenkins.plugins:folder-auth · fixed in 1.4
- CVE-2022-27199A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permMaven · org.jenkins-ci.plugins:aws-credentials · fixed in 191.vcb_f183ce58b_9
- CVE-2022-27198A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackersMaven · org.jenkins-ci.plugins:aws-credentials
- CVE-2022-27197Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stMaven · org.jenkins-ci.plugins:dashboard-view · fixed in 2.18.1
- CVE-2022-27196Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scriptiMaven · org.jvnet.hudson.plugins:favorite · fixed in 2.4.1
- CVE-2022-27195Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Maven · org.jenkins-ci.plugins:parameterized-trigger · fixed in 2.43.1
- CVE-2022-24721Incorrect Authorization in org.cometd.oortMaven · org.cometd.java:cometd-java-oort · fixed in 5.0.11, 6.0.6, 7.0.6
- CVE-2021-44667A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.Maven · com.alibaba.nacos:nacos-common · fixed in 2.1.0-BETA, 1.4.5
- CVE-2018-25031Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.Maven · org.webjars:swagger-ui · fixed in 4.1.3
- CVE-2020-36518jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.13.2.1, 2.12.6.1
- CVE-2021-44585A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.Maven · org.jeecgframework.boot:jeecg-boot-base, org.jeecgframework.boot:jeecg-boot-base-core · fixed in 3.1.0
- CVE-2021-38296Apache Spark Key Negotiation VulnerabilityMaven · org.apache.spark:spark-core · fixed in 3.1.3
- CVE-2022-26520In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary Maven · org.postgresql:postgresql · fixed in 42.3.3