Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-23437Infinite loop within Apache XercesJ xml parserMaven · xerces:xercesimpl · fixed in 2.12.2
- CVE-2021-23460Prototype PollutionMaven · org.webjars.npm:min-dash · fixed in 3.8.1
- CVE-2022-22930A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code viMaven · net.mingsoft:ms-mcms · fixed in 5.2.9
- CVE-2022-23315MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.Maven · net.mingsoft:ms-mcms
- CVE-2022-22929MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbiMaven · net.mingsoft:ms-mcms
- CVE-2022-0219Improper Restriction of XML External Entity Reference in skylot/jadxMaven · io.github.skylot:jadx-core · fixed in 1.3.2
- CVE-2022-21363Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).Maven · mysql:mysql-connector-java · fixed in 8.0.28
- CVE-2022-23435decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.Maven · pl.droidsonroids.gif:android-gif-drawable · fixed in 1.2.24
- CVE-2022-23221H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGMaven · com.h2database:h2 · fixed in 2.1.210
- CVE-2022-21700Memory leak in micronaut-coreMaven · io.micronaut:micronaut-http · fixed in 3.2.7
- CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.Maven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2022-23305SQL injection in JDBC Appender in Apache Log4j V1Maven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2022-23302Deserialization of untrusted data in JMSSink in Apache Log4j 1.xMaven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2021-42357DOM based XSS Vulnerability in Apache KnoxMaven · org.apache.knox:gateway-service-knoxsso · fixed in 1.6.1
- CVE-2022-0239Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpMaven · edu.stanford.nlp:stanford-corenlp · fixed in 4.4.0
- CVE-2022-0198Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpMaven · edu.stanford.nlp:stanford-corenlp
- CVE-2022-23118Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attaMaven · ru.yandex.jenkins.plugins.debuilder:debian-package-builder
- CVE-2022-23117Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve aMaven · org.conjur.jenkins:conjur-credentials · fixed in 1.0.10
- CVE-2022-23116Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt seMaven · org.conjur.jenkins:conjur-credentials · fixed in 1.0.10
- CVE-2022-23115Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access toMaven · org.jenkins-ci.plugins:batch-task
- CVE-2022-23114Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller wherMaven · org.jenkins-ci.plugins:publish-over-ssh · fixed in 1.23
- CVE-2022-23113Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting iMaven · org.jenkins-ci.plugins:publish-over-ssh · fixed in 1.23
- CVE-2022-23112A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an atMaven · org.jenkins-ci.plugins:publish-over-ssh · fixed in 1.24
- CVE-2022-23111A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attaMaven · org.jenkins-ci.plugins:publish-over-ssh · fixed in 1.23
- CVE-2022-23110Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulneMaven · org.jenkins-ci.plugins:publish-over-ssh · fixed in 1.23
- CVE-2022-23109Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions wheMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin · fixed in 3.8.0
- CVE-2022-23108Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resultiMaven · org.jenkins-ci.plugins:badge · fixed in 1.9.1
- CVE-2022-23107Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackeMaven · io.jenkins.plugins:warnings-ng · fixed in 9.10.3, 9.7.1, 9.5.2 and more
- CVE-2022-23105Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active DirectoMaven · org.jenkins-ci.plugins:active-directory · fixed in 2.25.1
- CVE-2022-20621Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller whereMaven · org.jenkins-ci.plugins:metrics · fixed in 4.0.2.8.1, 4.0.2.7.1