Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-52797Searching Opencast may cause a denial of serviceMaven · org.opencastproject:opencast-elasticsearch-impl · fixed in 13.10, 14.3, 16.7
- CVE-2024-49203Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery.Maven · com.querydsl:querydsl-apt, com.querydsl:querydsl-jpa +2 · fixed in 6.10.1, 5.6.1
- CVE-2024-31141Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProviderMaven · org.apache.kafka:kafka-clients · fixed in 3.7.1
- CVE-2024-52506Graylog can leak other users' reports via concurrent PDF report renderingMaven · org.graylog:graylog-parent · fixed in 6.1.2
- CVE-2024-52318Apache Tomcat: Incorrect JSP tag recycling leads to XSSMaven · org.apache.tomcat.embed:tomcat-embed-jasper, org.apache.tomcat:tomcat +1 · fixed in 9.0.97, 11.0.1, 10.1.32
- CVE-2024-52317Apache Tomcat: Request/response mix-up with HTTP/2Maven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 9.0.96, 10.1.31, 11.0.0
- CVE-2024-52316Apache Tomcat: Authentication bypass when using Jakarta Authentication APIMaven · org.apache.tomcat:tomcat-catalina · fixed in 9.0.96, 10.1.30, 11.0.1
- CVE-2024-38828CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameterMaven · org.springframework:spring-webmvc · fixed in 5.3.42
- CVE-2023-4639Undertow: cookie smuggling/spoofingMaven · io.undertow:undertow-core · fixed in 2.3.11.Final, 2.2.30.Final
- CVE-2023-1419Debezium: script injection via connector parameterMaven · io.debezium:debezium-connector-mysql, io.debezium:debezium-connector-sqlserver +1 · fixed in 2.3.0.Alpha1
- CVE-2023-0657Keycloak: impersonation via logout token exchangeMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2024-39610Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026.Maven · org.fitnesse:fitnesse · fixed in 20241026
- CVE-2024-42499Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026.Maven · org.fitnesse:fitnesse · fixed in 20241026
- CVE-2022-2232Keycloak: ldap injection on username inputMaven · org.keycloak:keycloak-ldap-federation, org.keycloak:keycloak-services · fixed in 23.0.1
- CVE-2024-52554Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that theMaven · io.jenkins.plugins:shared-library-version-override · fixed in 19.v3a
- CVE-2024-52553Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:oic-auth · fixed in 4.421.v5422614eb
- CVE-2024-52552Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resMaven · org.jenkins-ci.plugins:authorize-project · fixed in 1.8.0
- CVE-2024-52551Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restMaven · org.jenkinsci.plugins:pipeline-model-parent · fixed in 2.2218.v56d0cda
- CVE-2024-52550Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (JenkinsfileMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 3993.v3e20a
- CVE-2024-52549Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perMaven · org.jenkins-ci.plugins:script-security · fixed in 1368.vb
- CVE-2024-47535Denial of Service attack on windows app using NettyMaven · io.netty:netty-common · fixed in 4.1.115.Final
- CVE-2024-51135An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensMaven · org.powertac:server-interface
- CVE-2024-52007XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`Maven · ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 +4 · fixed in 6.4.0
- CVE-2024-47072XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input streamMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.21
- CVE-2023-1973Undertow: unrestricted request storage leads to memory exhaustionMaven · io.undertow:undertow-core · fixed in 2.2.32.Final, 2.3.13.Final
- CVE-2023-1932Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xssMaven · org.hibernate.validator:hibernate-validator, org.hibernate:hibernate-validator · fixed in 6.2.0.Final
- CVE-2024-51504Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerMaven · org.apache.zookeeper:zookeeper · fixed in 3.9.3
- CVE-2024-38286Apache Tomcat: Denial of ServiceMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 11.0.0-M21, 10.1.25, 9.0.90
- CVE-2024-51132An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary Maven · ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 +7 · fixed in 6.4.0
- CVE-2024-23590Apache Kylin: Session fixation in web interfaceMaven · org.apache.kylin:kylin · fixed in 5.0.0