Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-15522Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue wiMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-ext-jdk15on +6 · fixed in 1.0.2.1, 1.66
- CVE-2021-29052The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefiniMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.fp1
- CVE-2021-29048Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp11, 7.3.10.fp1, 7.3.6
- CVE-2021-29051Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.1.10.fp21, 7.2.10.fp10, 7.3.10.fp1 and more
- CVE-2021-29044Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5,Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp97, 7.1.10.fp21, 7.2.10.fp10 and more
- CVE-2021-29043The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fiMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp97, 7.1.10.fp21, 7.2.10.fp10 and more
- CVE-2021-29053Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to exeMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.fp1, 7.3.6
- CVE-2021-29046Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 befMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.fp1
- CVE-2021-29045Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, andMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.fp1
- CVE-2021-29047The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers afMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.fp1, 7.3.6
- CVE-2021-29041Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticMaven · com.liferay.portal:release.dxp.bom · fixed in 7.3.10.fp1
- CVE-2021-29040The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fixMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp97, 7.1.10.fp20, 7.2.10.fp10 and more
- CVE-2021-29039Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackerMaven · com.liferay.portal:release.portal.bom · fixed in 7.3.5
- CVE-2021-29506Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.Maven · com.graphhopper:graphhopper-nav · fixed in 2.4
- CVE-2021-22137In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used.Maven · org.elasticsearch:elasticsearch · fixed in 7.11.2, 6.8.15
- CVE-2021-22135Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API Maven · org.elasticsearch:elasticsearch · fixed in 7.11.2, 6.8.15
- CVE-2021-20250A flaw was found in wildfly.Maven · org.jboss:jboss-ejb-client · fixed in 4.0.39
- CVE-2021-20202A flaw was found in keycloak.Maven · org.keycloak:keycloak-core · fixed in 13.0.0
- CVE-2021-21655A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specifiMaven · org.jenkins-ci.plugins:p4 · fixed in 1.11.5
- CVE-2021-21656Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:xcode-plugin · fixed in 2.0.15
- CVE-2021-21654Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read perMaven · org.jenkins-ci.plugins:p4 · fixed in 1.11.5
- CVE-2021-21652A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to coMaven · org.jenkins-ci.plugins:xray-connector · fixed in 2.4.1
- CVE-2021-21653Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with OverMaven · org.jenkins-ci.plugins:xray-connector · fixed in 2.4.1
- CVE-2021-21651Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReadMaven · org.jenkins-ci.plugins:s3 · fixed in 0.11.7, 0.11.5.1
- CVE-2021-21649Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-siteMaven · org.jenkins-ci.plugins:dashboard-view · fixed in 2.16, 2.12.1
- CVE-2021-21650Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, alMaven · org.jenkins-ci.plugins:s3 · fixed in 0.11.7, 0.11.5.1
- CVE-2021-21648Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected crMaven · org.jenkins-ci.plugins:credentials · fixed in 2.3.19, 2.3.15.1, 2.3.14.1 and more
- CVE-2021-32053JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via historyMaven · ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base · fixed in 5.4.0
- CVE-2021-21430Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala codeMaven · org.openapitools:openapi-generator · fixed in 5.1.0
- CVE-2021-21428Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generatorMaven · org.openapitools:openapi-generator-online · fixed in 5.1.0