Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-33338The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRFMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.1.10.fp19, 7.2.10.fp6, 7.3.3
- CVE-2021-33336Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.1.10.fp18, 7.2.10.fp7, 7.3.4
- CVE-2021-33339Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp9, 7.3.5
- CVE-2021-33335Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.1.10.fp20, 7.2.10.fp9, 7.3.5
- CVE-2021-33332Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 befoMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.1.10.fp19, 7.2.10.fp7
- CVE-2021-33334The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp94, 7.1.10.fp19, 7.2.10.fp6
- CVE-2021-33333The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 beforMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp93, 7.1.10.fp19, 7.2.10.fp6
- CVE-2021-33331Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 bMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp94, 7.1.10.fp19, 7.2.10.fp8
- CVE-2021-33330Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected rMaven · com.liferay.portal:release.portal.bom · fixed in 7.3.3
- CVE-2021-33327The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.portlet.configuration.web · fixed in 7.0.10.fp95, 7.1.10.fp19, 7.2.10.fp8 and more
- CVE-2021-33328Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp96, 7.1.10.fp20, 7.2.10.fp9
- CVE-2021-33326Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.frontend.js.aui.web · fixed in 7.0.10.fp96, 7.1.10.fp20, 7.2.10.fp9 and more
- CVE-2021-33325The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 befoMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp93, 7.1.10.fp19, 7.2.10.fp7
- CVE-2021-33322In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password resMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom · fixed in 5.7.3, 7.0.10.fp96, 7.1.10.fp18 and more
- CVE-2021-33324The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properlMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.1.10.fp20, 7.2.10.fp5, 7.3.2
- CVE-2021-33323The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, auMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.dynamic.data.mapping.form.web · fixed in 7.1.10.fp19, 7.2.10.fp7, 3.0.23
- CVE-2021-33321Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user Maven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.portal.bom · fixed in 5.11.0, 7.3.3
- CVE-2021-33320The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pacMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.flags.taglib · fixed in 7.0.10.fp96, 7.1.10.fp20, 7.2.10.fp5 and more
- CVE-2021-37578Remote code execution via RMIMaven · org.apache.juddi:juddi-core · fixed in 3.3.10
- CVE-2021-34802A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users Maven · org.neo4j:neo4j-kernel · fixed in 4.2.8
- CVE-2021-22144In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack wasMaven · org.elasticsearch:elasticsearch · fixed in 6.8.17, 7.13.3
- CVE-2021-33900StartTLS and SASL confidentiality protection bypassMaven · org.apache.directory.studio:org.apache.directory.studio.parent · fixed in 2.0.0.v20210717-M17
- CVE-2021-23408Prototype PollutionMaven · com.graphhopper:graphhopper-web-bundle · fixed in 3.2
- CVE-2021-22145A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting.Maven · org.elasticsearch.client:elasticsearch-rest-client · fixed in 7.13.4
- CVE-2021-35043OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected).Maven · org.owasp.antisamy:antisamy · fixed in 1.6.4
- CVE-2021-32014SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is Maven · org.webjars.npm:xlsx · fixed in 0.17.0
- CVE-2021-32013SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that Maven · org.webjars.npm:xlsx · fixed in 0.17.0
- CVE-2021-32012SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that Maven · org.webjars.npm:xlsx · fixed in 0.17.0
- CVE-2021-32769Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-coreMaven · io.micronaut:micronaut-http-server-netty · fixed in 2.5.9
- CVE-2021-34429For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the conMaven · org.eclipse.jetty:jetty-webapp · fixed in 9.4.43, 10.0.6, 11.0.6