Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25191Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored crosMaven · io.jenkins.plugins:agent-server-parameter · fixed in 1.1
- CVE-2022-25190A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate crMaven · org.conjur.jenkins:conjur-credentials · fixed in 1.0.12
- CVE-2022-25189Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a storeMaven · io.jenkins.plugins:custom-checkbox-parameter · fixed in 1.2
- CVE-2022-25188Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackersMaven · org.jenkins-ci.plugins:fortify · fixed in 20.2.35
- CVE-2022-25187Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.Maven · org.jenkins-ci.plugins:support-core · fixed in 2.79.1
- CVE-2022-25186Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use Maven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin · fixed in 336.v182c0fbaaeb7
- CVE-2022-25185Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-Maven · org.jenkins-ci.plugins:generic-webhook-trigger · fixed in 1.82
- CVE-2022-25184Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the PMaven · org.jenkins-ci.plugins:pipeline-build-step · fixed in 2.15.1
- CVE-2022-25183Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directorMaven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 561.va_ce0de3c2d69
- CVE-2022-25182A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Maven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 561.va_ce0de3c2d69
- CVE-2022-25181A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Maven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 561.va_ce0de3c2d69
- CVE-2022-25180Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, alloMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2656.vf7a_e7b_75a_457
- CVE-2022-25178Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the librarMaven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 561.va_ce0de3c2d69, 2.21.1, 2.18.1
- CVE-2022-25177Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected PMaven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 561.va_ce0de3c2d69, 2.21.1, 2.18.1
- CVE-2022-25176Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for theMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2.94.1, 2.92.1, 2648.2651.v230593e03e9f
- CVE-2022-25174Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for PipeMaven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 561.va, 2.21.1, 2.18.1
- CVE-2022-25173Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script Maven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2656.vf7a, 2.94.1, 2.92.1
- CVE-2022-25175Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted Maven · org.jenkins-ci.plugins.workflow:workflow-multibranch · fixed in 707.v71c3f0a_6ccdb
- CVE-2022-25179Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory forMaven · org.jenkins-ci.plugins.workflow:workflow-multibranch · fixed in 2.26.1, 2.23.1, 696.698.v9b4218eea50f and more
- CVE-2021-46366An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site RMaven · info.magnolia:magnolia-core · fixed in 6.2.4
- CVE-2021-46365An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.Maven · info.magnolia:magnolia-core · fixed in 6.2.4
- CVE-2021-46364A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML fileMaven · info.magnolia:magnolia-core · fixed in 6.2.4
- CVE-2021-46363An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS filesMaven · info.magnolia:magnolia-core · fixed in 6.2.4
- CVE-2021-46361An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary codMaven · info.magnolia:magnolia-core · fixed in 6.2.12
- CVE-2022-24289Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versionsMaven · org.apache.cayenne:cayenne-server · fixed in 4.1.1
- CVE-2021-44521Remote code execution for scripted UDFsMaven · org.apache.cassandra:cassandra-all · fixed in 3.0.26, 3.11.12, 4.0.2
- CVE-2022-23622Cross site scripting in registration template in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 12.10.11, 13.4.7, 13.10.3
- CVE-2022-23621Missing authorization in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.7-rc-1, 13.4.3, 12.10.9
- CVE-2022-23620Path traversal in xwiki-platform-skin-skinxMaven · org.xwiki.platform:xwiki-platform-skin-skinx · fixed in 13.6
- CVE-2022-23619Information exposure in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-web · fixed in 13.6RC1, 13.4.1, 12.10.9