Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-46037MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.Maven · net.mingsoft:ms-mcms
- CVE-2021-46036An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary codeMaven · net.mingsoft:ms-mcms
- CVE-2022-0673A flaw was found in LemMinX in versions prior to 0.19.0.Maven · org.eclipse.lemminx:lemminx-parent · fixed in 0.19.0
- CVE-2022-0672A flaw was found in LemMinX in versions prior to 0.19.0.Maven · org.eclipse.lemminx:lemminx-parent · fixed in 0.19.0
- CVE-2022-0671A flaw was found in vscode-xml in versions prior to 0.19.0.Maven · org.eclipse.lemminx:lemminx-parent · fixed in 0.19.0
- CVE-2021-44868A problem was found in ming-soft MCMS v5.1.Maven · net.mingsoft:ms-mcms
- CVE-2022-22885Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.Maven · cn.hutool:hutool-http · fixed in 5.7.19
- CVE-2022-22880Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.Maven · org.jeecgframework.boot:jeecg-boot-base, org.jeecgframework.boot:jeecg-boot-base-core
- CVE-2022-22881Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.Maven · org.jeecgframework.boot:jeecg-boot-base, org.jeecgframework.boot:jeecg-boot-base-core
- CVE-2022-25212A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-speciMaven · org.continuousassurance.swamp.jenkins:swamp
- CVE-2022-25211A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attackerMaven · org.continuousassurance.swamp.jenkins:swamp
- CVE-2022-25210Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers withMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-25209Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2022-25208A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins senMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2022-25207A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2022-25206A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifiMaven · org.jenkins-ci.plugins:dbcharts
- CVE-2022-25205A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-spMaven · org.jenkins-ci.plugins:dbcharts
- CVE-2022-25204Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown oMaven · by.dev.madhead.doktor:doktor
- CVE-2022-25203Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploMaven · com.sonymobile.jenkins.plugins.teamviews:team-views
- CVE-2022-25202Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-sitMaven · org.jenkins-ci.plugins:promoted-builds-simple
- CVE-2022-25201Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attMaven · com.checkmarx.jenkins:checkmarx · fixed in 2022.1.3
- CVE-2022-25200A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attackeMaven · com.checkmarx.jenkins:checkmarx · fixed in 2022.1.3
- CVE-2022-25199A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an atMaven · org.jenkins-ci.plugins:scp
- CVE-2022-25198A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attackerMaven · org.jenkins-ci.plugins:scp
- CVE-2022-25197Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files onMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin · fixed in 351.vdb_f83a_1c6a_9d
- CVE-2022-25196Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authenticMaven · org.jenkins-ci.plugins:gitlab-oauth
- CVE-2022-25195A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacMaven · io.jenkins.plugins:autonomiq · fixed in 1.16
- CVE-2022-25194A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-spMaven · io.jenkins.plugins:autonomiq · fixed in 1.16
- CVE-2022-25193Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an atMaven · io.jenkins.plugins:embotics-vcommander · fixed in 2.0
- CVE-2022-25192A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attackMaven · io.jenkins.plugins:embotics-vcommander