Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-54677Apache Tomcat: DoS in examples web applicationMaven · org.apache.tomcat:tomcat · fixed in 11.0.2, 10.1.34, 9.0.98
- CVE-2024-50379Apache Tomcat: RCE due to TOCTOU issue in JSP compilationMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 11.0.2, 10.1.34, 9.0.98
- CVE-2024-49194Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL pMaven · com.databricks:databricks-jdbc · fixed in 2.6.40
- CVE-2024-35230Welcome and About GeoServer pages communicate version and revision informationMaven · org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-core · fixed in 2.25.1
- CVE-2024-55887Ucum-java has an XXE vulnerability in XML parsingMaven · org.fhir:ucum · fixed in 1.0.9
- CVE-2024-55879XWiki allows RCE from script right in configurable sectionsMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 15.10.9, 16.3.0
- CVE-2024-55877XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosListMaven · org.xwiki.platform:xwiki-platform-help-ui · fixed in 15.10.11, 16.4.1, 16.5.0
- CVE-2024-55876XWiki's scheduler in subwiki allows scheduling operations for any main wiki userMaven · org.xwiki.platform:xwiki-platform-scheduler-ui · fixed in 15.10.9, 16.3.0
- CVE-2024-55875http4k has a potential XXE (XML External Entity Injection) vulnerabilityMaven · org.http4k:http4k-format-xml · fixed in 6.50.0.0
- CVE-2024-55663XWiki Platform has an SQL injection in getdocuments.vm with sort parameterMaven · org.xwiki.platform:xwiki-platform-distribution-war · fixed in 13.10.5, 14.3-rc-1
- CVE-2024-55662XWiki allows remote code execution through the extension sheetMaven · org.xwiki.platform:xwiki-platform-repository-server-ui · fixed in 15.10.9, 16.3.0
- CVE-2024-12397Io.quarkus.http/quarkus-http-core: quarkus http cookie smugglingMaven · io.quarkus.http:quarkus-http-core · fixed in 5.3.4
- CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checksMaven · org.apache.struts:struts2-core · fixed in 6.4.0
- CVE-2024-12369Elytron-oidc-client: oidc authorization code injectionMaven · org.wildfly.security:wildfly-elytron, org.wildfly.security:wildfly-elytron-http-oidc · fixed in 2.2.9.Final, 2.6.2.Final
- CVE-2024-54140sigstore-java has a vulnerability with bundle verificationMaven · dev.sigstore:sigstore-java · fixed in 1.2.0
- CVE-2022-41137Apache Hive: Deserialization of untrusted data when fetching partitions from the MetastoreMaven · org.apache.hive:hive-exec · fixed in 4.0.0-alpha-2
- CVE-2024-38829Spring LDAP sensitive data exposure for case-sensitive comparisonsMaven · org.springframework.ldap:spring-ldap-core · fixed in 3.2.8, 2.4.4
- CVE-2024-45106Apache Ozone: Improper authentication when generating S3 secretsMaven · org.apache.ozone:ozone · fixed in 1.4.1
- CVE-2024-53990AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`sMaven · org.asynchttpclient:async-http-client · fixed in 2.12.4, 3.0.1
- CVE-2024-38827Spring Security Authorization Bypass for Case Sensitive ComparisonsMaven · org.springframework.security:spring-security-core · fixed in 5.7.14, 5.8.16, 6.0.14 and more
- CVE-2024-52800Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLIMaven · org.verapdf:core, org.verapdf:core-arlington +7 · fixed in 1.26.2
- CVE-2024-35371Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs.Maven · io.antmedia:ant-media-server · fixed in 2.9.0
- CVE-2024-54004Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, alloMaven · aendter.jenkins.plugins:filesystem-list-parameter-plugin · fixed in 0.0.15
- CVE-2024-54003Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability Maven · io.jenkins.plugins:simple-queue · fixed in 1.4.5
- CVE-2024-53267Vulnerability with bundle verification in sigstore-javaMaven · dev.sigstore:sigstore-java · fixed in 1.1.0
- CVE-2024-10492Keycloak-quarkus-server: keycloak path trasversalMaven · org.keycloak:keycloak-quarkus-server · fixed in 26.0.6
- CVE-2024-10451Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build processMaven · org.keycloak:keycloak-quarkus-server · fixed in 24.0.9, 26.0.6
- CVE-2024-10270Org.keycloak:keycloak-services: keycloak denial of serviceMaven · org.keycloak:keycloak-services · fixed in 24.0.9, 26.0.6
- CVE-2024-9666Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilityMaven · org.keycloak:keycloak-quarkus-server · fixed in 26.0.6
- CVE-2024-52067Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug LogMaven · org.apache.nifi:nifi-framework-core · fixed in 1.28.1, 2.0.0