Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-51127An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.Maven · org.hornetq:hornetq-core-client
- CVE-2024-48307JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2024-43382Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypMaven · net.snowflake:snowflake-jdbc · fixed in 3.20.0
- CVE-2024-45477Apache NiFi: Improper Neutralization of Input in Parameter DescriptionMaven · org.apache.nifi:nifi-web-ui · fixed in 1.28.0, 2.0.0-M4
- CVE-2024-49771MPXJ has a Potential Path Traversal VulnerabilityMaven · net.sf.mpxj:mpxj · fixed in 13.5.1
- CVE-2024-38821Authorization Bypass of Static Resources in WebFlux ApplicationsMaven · org.springframework.security:spring-security-web · fixed in 5.7.13, 5.8.15, 6.2.7 and more
- CVE-2024-49760OpenRefine has a path traversal in LoadLanguageCommandMaven · org.openrefine:openrefine · fixed in 3.8.3
- CVE-2024-47883Butterfly has path/URL confusion in resource handling leading to multiple weaknessesMaven · org.openrefine.dependencies:butterfly · fixed in 1.2.6
- CVE-2024-47882OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious projectMaven · org.openrefine:openrefine · fixed in 3.8.3
- CVE-2024-47881OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)Maven · org.openrefine:database · fixed in 3.8.3
- CVE-2024-47880OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommandMaven · org.openrefine:openrefine · fixed in 3.8.3
- CVE-2024-47879OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)Maven · org.openrefine:main · fixed in 3.8.3
- CVE-2024-47878Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)Maven · org.openrefine:extensions · fixed in 3.8.3
- CVE-2024-45031Apache Syncope: Stored XSS in Console and EnduserMaven · org.apache.syncope.client:syncope-client-console
- CVE-2024-38002The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through…Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q4.6, 2023.Q3.9, 7.3.10.u36 and more
- CVE-2024-26273Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.QMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q4.3, 2023.Q3.6, 7.4u93 and more
- CVE-2024-26272Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.QMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q4.3, 2023.Q3.6, 7.3u36 and more
- CVE-2024-8980The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q3.5, 7.3.10.u36, 7.4.3.102-GA102
- CVE-2024-26271Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q4.3, 2023.Q3.6, 7.3u37 and more
- CVE-2024-38820CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match ExceptionMaven · org.springframework:spring-context, org.springframework:spring-web · fixed in 6.1.14
- CVE-2024-49580In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosureMaven · io.ktor:ktor-client-core-jvm · fixed in 2.3.13
- CVE-2024-45217Apache Solr: ConfigSets created during a backup restore command are trusted implicitlyMaven · org.apache.solr:solr · fixed in 8.11.4, 9.7.0
- CVE-2024-45216Apache Solr: Authentication bypass possible using a fake URL Path endingMaven · org.apache.solr:solr · fixed in 8.11.4, 9.7.0
- CVE-2024-47876Sakai: Kernel users created with type roleview can login as a normal userMaven · org.sakaiproject.kernel:sakai-kernel-impl · fixed in 23.3
- CVE-2023-50780Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansMaven · org.apache.activemq:artemis-cli · fixed in 2.29.0
- CVE-2024-8184Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacksMaven · org.eclipse.jetty:jetty-server · fixed in 12.0.9, 10.0.24, 11.0.24 and more
- CVE-2024-6762Jetty PushSessionCacheFilter can cause remote DoS attacksMaven · org.eclipse.jetty:jetty-servlets · fixed in 10.0.18, 11.0.18, 12.0.4
- CVE-2024-6763Jetty URI parsing of invalid authorityMaven · org.eclipse.jetty:jetty-http · fixed in 12.0.12
- CVE-2024-9823Jetty DOS vulnerability on DosFilterMaven · org.eclipse.jetty.ee10:jetty-ee10-servlets, org.eclipse.jetty.ee8:jetty-ee8-servlets +2 · fixed in 12.0.3, 9.4.54, 10.0.18 and more
- CVE-2024-21534All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.Maven · org.webjars.npm:jsonpath-plus