Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-25581Deserialization of untrusted data in InternalAttributeHandler in pac4jMaven · org.pac4j:pac4j-core · fixed in 4.0.0
- CVE-2024-3656Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesMaven · org.keycloak:keycloak-services · fixed in 24.0.5
- CVE-2024-28168Apache XML Graphics FOP: XML External Entity (XXE) ProcessingMaven · org.apache.xmlgraphics:fop-core · fixed in 2.10
- CVE-2024-9622Resteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4Maven · org.jboss.resteasy:resteasy-netty4-cdi
- CVE-2024-9621Io.quarkiverse.cxf:quarkus-cxf: quarkus cxf may log user password and secret to application logMaven · io.quarkiverse.cxf:quarkus-cxf · fixed in 3.15.2
- CVE-2024-47855util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.Maven · net.sf.json-lib:json-lib, org.kordamp.json:json-lib-core · fixed in 3.1.0
- CVE-2024-47554Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderMaven · commons-io:commons-io · fixed in 2.14.0
- CVE-2024-47561Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)Maven · org.apache.avro:avro · fixed in 1.11.4
- CVE-2024-47807Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowiMaven · org.jenkins-ci.plugins:oic-auth · fixed in 4.355.v3a
- CVE-2024-47806Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, alloMaven · org.jenkins-ci.plugins:oic-auth · fixed in 4.355.v3a
- CVE-2024-47805Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentiMaven · org.jenkins-ci.plugins:credentials · fixed in 1381.v2c3a, 1371.1373.v4eb
- CVE-2024-47804If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.462.3, 2.479
- CVE-2024-47803Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissionsMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.462.3, 2.479
- CVE-2024-45772Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization IssueMaven · org.apache.lucene:lucene-replicator · fixed in 9.12.0
- CVE-2024-9329Glassfish redirect to untrusted siteMaven · org.glassfish.main.admin:rest-service · fixed in 7.0.17
- CVE-2024-38809Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.Maven · org.springframework:spring-web · fixed in 5.3.38, 6.0.23, 6.1.12
- CVE-2024-47197Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentialsMaven · org.apache.maven.plugins:maven-archetype-plugin · fixed in 3.3.0
- CVE-2024-23454Apache Hadoop: Temporary File Local Information DisclosureMaven · org.apache.hadoop:hadoop-common · fixed in 3.4.0
- CVE-2024-39928Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerabilityMaven · org.apache.linkis:linkis-engineplugin-spark · fixed in 1.6.0
- CVE-2024-46997DataEase's H2 datasource has a remote command execution riskMaven · io.dataease:common · fixed in 2.10.1
- CVE-2024-46985DataEase has an XXE vulnerabilityMaven · io.dataease:common · fixed in 2.10.1
- CVE-2024-46983Remote Command Execution(RCE) Vulnerbility in sofa-hessianMaven · com.alipay.sofa:hessian · fixed in 3.5.5
- CVE-2024-46984XML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidatorMaven · de.gematik.refv.commons:commons · fixed in 2.5.1
- CVE-2024-8883Keycloak: vulnerable redirect uri validation results in open redirecMaven · org.keycloak:keycloak-services · fixed in 22.0.13, 24.0.8, 25.0.6
- CVE-2024-8698Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakMaven · org.keycloak:keycloak-saml-core · fixed in 22.0.13, 24.0.8, 25.0.6
- CVE-2024-7254Stack overflow in Protocol Buffers Java LiteMaven · com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-javalite +2 · fixed in 3.25.5, 4.27.5, 4.28.2
- CVE-2024-46978Missing checks for notification filter preferences editions in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-notifications-ui · fixed in 14.10.21, 15.5.5, 15.10.1
- CVE-2024-46979Data leak of notification filters of users in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-notifications-ui · fixed in 14.10.21, 15.5.5, 15.10.1
- CVE-2024-45537Apache Druid: Users can provide MySQL JDBC properties not on allow listMaven · org.apache.druid:druid · fixed in 30.0.1
- CVE-2024-45384Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle AttackMaven · org.apache.druid.extensions:druid-pac4j · fixed in 30.0.1