Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-23618Open Redirect in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 12.10.7, 13.3RC1
- CVE-2022-23617Missing authorization in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 12.10.6, 13.2-rc-1
- CVE-2022-23616Remote code execution in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 13.1RC1
- CVE-2022-23615Partial authorization bypass on document save in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 13.0
- CVE-2022-0538Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections forMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.334, 2.319.3
- CVE-2022-22931Path traversal in Apache James 3.6.1Maven · org.apache.james:james-server · fixed in 3.6.2
- CVE-2022-23913Apache ActiveMQ Artemis DoSMaven · org.apache.activemq:artemis-core-client · fixed in 2.19.1
- CVE-2021-36152Insecure TrustManager used in LDAP connectionsMaven · org.apache.gobblin:gobblin-core · fixed in 0.16.0
- CVE-2021-36151Local Credentials Disclosure VulnerabilityMaven · org.apache.gobblin:gobblin-core · fixed in 0.16.0
- CVE-2021-43841XSS by SVG upload in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-tool-configuration-resources · fixed in 12.10.6, 13.3RC1
- CVE-2021-32732Cross-Site Request Forgery in xwiki-platformMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 12.10.5, 13.2RC1
- CVE-2022-21724Unchecked Class Instantiation when providing Plugin ClassesMaven · org.postgresql:postgresql · fixed in 42.2.25, 42.3.2
- CVE-2021-41571Pulsar Admin API allows access to data from other tenants using getMessageById APIMaven · org.apache.pulsar:pulsar · fixed in 2.7.4, 2.8.1
- CVE-2021-43859Denial of Service by injecting highly recursive collections or maps in XStreamMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.19
- CVE-2022-23596Infinite loop in junrarMaven · com.github.junrar:junrar · fixed in 7.4.1
- CVE-2022-24196iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, whMaven · com.itextpdf:itext7-core · fixed in 7.1.18
- CVE-2022-24197iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause aMaven · com.itextpdf:itext7-core · fixed in 7.1.18
- CVE-2022-24198iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackerMaven · com.itextpdf:itext7-core · fixed in 7.2.0
- CVE-2022-23181Local privilege escalation with FileStoreMaven · org.apache.tomcat:tomcat · fixed in 10.0.16, 9.0.58, 8.5.75
- CVE-2021-46385https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection.Maven · net.mingsoft:ms-mcms
- CVE-2021-46383https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection.Maven · net.mingsoft:ms-mcms · fixed in 5.2.6
- CVE-2022-22932Path traversal flawsMaven · org.apache.karaf:apache-karaf · fixed in 4.3.6, 4.2.15
- CVE-2021-41766Insecure Java Deserialization in Apache KarafMaven · org.apache.karaf.management:org.apache.karaf.management.server · fixed in 4.3.6
- CVE-2021-46386File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to nMaven · net.mingsoft:ms-mcms
- CVE-2021-4133A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create newMaven · org.keycloak:keycloak-services · fixed in 15.1.1
- CVE-2021-46089In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.Maven · org.jeecgframework.boot:jeecg-boot-base, org.jeecgframework.boot:jeecg-boot-base-core
- CVE-2022-23945Apache ShenYu missing authentication allows gateway registrationMaven · org.apache.shenyu:shenyu-common · fixed in 2.4.2
- CVE-2022-23944Apache ShenYu 2.4.1 Improper access controlMaven · org.apache.shenyu:shenyu-common · fixed in 2.4.2
- CVE-2022-23223Apache ShenYu Password leakageMaven · org.apache.shenyu:shenyu-common · fixed in 2.4.2
- CVE-2021-45029Apache ShenYu 2.4.1 Groovy Code Injection & SpEL InjectionMaven · org.apache.shenyu:shenyu-common · fixed in 2.4.2