Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25312An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractorMaven · org.apache.any23:apache-any23 · fixed in 2.7
- CVE-2021-46384https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE.Maven · net.mingsoft:ms-mcms · fixed in 5.2.6
- CVE-2022-0839Improper Restriction of XML External Entity Reference in liquibase/liquibaseMaven · org.liquibase:liquibase-core · fixed in 4.8.0
- CVE-2022-26336A carefully crafted TNEF file can cause an out of memory exceptionMaven · org.apache.poi:poi-scratchpad · fixed in 5.2.1
- CVE-2022-23708A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built proMaven · org.elasticsearch:elasticsearch · fixed in 7.17.1
- CVE-2022-0265Improper Restriction of XML External Entity Reference in hazelcast/hazelcastMaven · com.hazelcast:hazelcast · fixed in 5.1
- CVE-2022-23898MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.Maven · net.mingsoft:ms-mcms
- CVE-2022-23899MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.Maven · net.mingsoft:ms-mcms
- CVE-2022-22947In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatMaven · org.springframework.cloud:spring-cloud-gateway · fixed in 3.0.7, 3.1.1
- CVE-2022-25146The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the oMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.remote.app.web · fixed in 7.4.13.u5, 2.0.21
- CVE-2021-38269Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 beforMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.gogo.shell.web · fixed in 7.1.10.fp23, 7.2.10.fp13, 7.3.10.fp2 and more
- CVE-2021-38267Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom +1 · fixed in 7.3.10.fp2, 7.3.7-ga8, 5.0.0
- CVE-2021-38263Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 befoMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.server.admin.web · fixed in 4.0.12
- CVE-2021-38264Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject aMaven · com.liferay:com.liferay.frontend.taglib.clay · fixed in 7.1.15
- CVE-2021-38265Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrarMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.layout.admin.web · fixed in 5.0.0
- CVE-2021-38266The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 beforMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.portal.security.ldap.impl · fixed in 7.3.0-ga1, 2.0.19
- CVE-2022-23640Improper Restriction of XML External Entity Reference in Excel-Streaming-ReaderMaven · com.monitorjbl:xlsx-streamer · fixed in 2.1.0
- CVE-2021-38268The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.dynamic.data.mapping.service · fixed in 7.0.10.fp101, 7.1.10.fp21, 7.2.10.fp10 and more
- CVE-2021-41193Use of Externally-Controlled Format String in wire-avsMaven · com.wire:avs · fixed in 7.1.12
- CVE-2021-42767A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and somMaven · org.neo4j.procedure:apoc · fixed in 3.5.17, 4.2.10, 4.3.0.4 and more
- CVE-2022-24329In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.Maven · org.jetbrains.kotlin:kotlin-stdlib · fixed in 1.6.0
- CVE-2022-24948Apache JSPWiki Cross-site scripting vulnerability on User Preferences screenMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.2
- CVE-2022-24947Apache JSPWiki CSRF Account TakeoverMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.2
- CVE-2022-24615zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application cMaven · net.lingala.zip4j:zip4j · fixed in 2.10.0
- CVE-2022-24614When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leaMaven · com.drewnoakes:metadata-extractor · fixed in 2.18.0
- CVE-2022-24613metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an Maven · com.drewnoakes:metadata-extractor · fixed in 2.18.0
- CVE-2021-44550An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).Maven · edu.stanford.nlp:stanford-corenlp · fixed in 4.4.0
- CVE-2022-23848In Alluxio before 2.7.3, the logserver does not validate the input stream.Maven · org.alluxio:alluxio-core-common · fixed in 2.7.3
- CVE-2021-46063MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.Maven · net.mingsoft:ms-mcms
- CVE-2021-46062MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.Maven · net.mingsoft:ms-basic, net.mingsoft:ms-mcms · fixed in 2.1.16, 5.2.11