Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-20620Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDMaven · org.jenkins-ci.plugins:ssh-agent · fixed in 1.23.2, 1.22.1
- CVE-2022-20619A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers tMaven · org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source · fixed in 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2 and more
- CVE-2022-20618A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read accessMaven · org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source · fixed in 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2 and more
- CVE-2022-20617Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulneraMaven · org.jenkins-ci.plugins:docker-commons · fixed in 1.18
- CVE-2022-20616Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing aMaven · org.jenkins-ci.plugins:credentials-binding · fixed in 1.27.1, 1.24.1
- CVE-2022-20615Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resultinMaven · org.jenkins-ci.plugins:matrix-project · fixed in 1.20, 1.18.1
- CVE-2022-20612A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build ofMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.330, 2.319.2
- CVE-2022-20613A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS Maven · org.jenkins-ci.plugins:mailer · fixed in 408.vd726a, 1.34.2
- CVE-2022-20614A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNMaven · org.jenkins-ci.plugins:mailer · fixed in 408.vd726a, 1.34.2
- CVE-2022-23106Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token aMaven · io.jenkins:configuration-as-code · fixed in 1.55.1, 1.54.1, 1.53.1 and more
- CVE-2021-43297Dubbo Hessian cause RCE when parse errorMaven · org.apache.dubbo:dubbo · fixed in 2.6.12, 2.7.15, 3.0.5
- CVE-2021-22060In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious Maven · org.springframework:spring-core · fixed in 5.3.14, 5.2.19
- CVE-2021-22569Denial of Service of protobuf-java parsing procedureMaven · com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-kotlin · fixed in 3.16.1, 3.18.2, 3.19.2
- CVE-2021-42392The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.Maven · com.h2database:h2 · fixed in 2.0.206
- CVE-2021-44878If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it wiMaven · org.pac4j:pac4j-oidc · fixed in 4.5.5, 5.3.1
- CVE-2021-45458Hardcoded credentialsMaven · org.apache.kylin:kylin · fixed in 3.1.3, 4.0.1
- CVE-2021-45457Overly broad CORS configurationMaven · org.apache.kylin:kylin · fixed in 3.1.3, 4.0.1
- CVE-2021-45456Command injectionMaven · org.apache.kylin:kylin · fixed in 4.0.1
- CVE-2021-36774Mysql JDBC Connector Deserialize RCEMaven · org.apache.kylin:kylin · fixed in 3.1.3
- CVE-2021-31522Apache Kylin unsafe class loadingMaven · org.apache.kylin:kylin · fixed in 3.1.3, 4.0.1
- CVE-2021-27738Improper Access Control to Streaming Coordinator & SSRFMaven · org.apache.kylin:kylin · fixed in 3.1.3
- CVE-2021-36739XSS vulnerability in the MVCBean JSP portlet maven archetypeMaven · org.apache.portals.pluto:pluto-portal · fixed in 3.1.1
- CVE-2021-36738XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portletMaven · org.apache.portals.pluto:pluto-portal · fixed in 3.1.1
- CVE-2021-36737XSS in V3 Demo PortletMaven · org.apache.portals.pluto:pluto-portal · fixed in 3.1.1
- CVE-2022-21653Hash collision in typelevel jawnMaven · org.typelevel:jawn-parser_0.25, org.typelevel:jawn-parser_0.27 +16 · fixed in 1.3.2
- CVE-2021-40525Sieve file storage vulnerable to path traversal attacksMaven · org.apache.james:james-server · fixed in 3.6.1
- CVE-2021-40111Apache James IMAP parsing Denial Of ServiceMaven · org.apache.james:james-server · fixed in 3.6.1
- CVE-2021-40110Apache James IMAP vulnerable to a ReDoSMaven · org.apache.james:james-server · fixed in 3.6.1
- CVE-2021-38542Apache James vulnerable to STARTTLS command injection (IMAP and POP3)Maven · org.apache.james:james-server · fixed in 3.6.1
- CVE-2021-34797Apache Geode project log file redaction of sensitive information vulnerabilityMaven · org.apache.geode:geode-core · fixed in 1.12.5, 1.13.5