Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-22399Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata ServerMaven · org.apache.seata:seata-core · fixed in 2.1.0, 1.8.1
- CVE-2024-46942In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entriesMaven · org.opendaylight.mdsal:mdsal-artifacts
- CVE-2024-46943An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3.Maven · org.opendaylight.aaa:aaa-artifacts
- CVE-2024-38816CVE-2024-38816: Path traversal vulnerability in functional web frameworksMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 6.1.13
- CVE-2024-8642Eclipse EDC: Consumer pull transfer token validation checks not appliedMaven · org.eclipse.edc:transfer-data-plane · fixed in 0.9.0
- CVE-2024-8646Eclipse Glassfish: URL redirection vulnerability to untrusted sitesMaven · org.glassfish.main.web:web-core · fixed in 7.0.10
- CVE-2023-6841Keycloak: amount of attributes per object is not limited and it may lead to dosMaven · org.keycloak:keycloak-core · fixed in 24.0.0
- CVE-2024-45591XWiki Platform document history including authors of any page exposed to unauthorized actorsMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 15.10.9, 16.3.0-rc-1
- CVE-2024-7341Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adaptersMaven · org.keycloak:keycloak-services · fixed in 22.0.12, 24.0.7, 25.0.5
- CVE-2024-7318Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverityMaven · org.keycloak:keycloak-core · fixed in 24.0.7, 25.0.4
- CVE-2024-7260Keycloak-core: open redirect on account pageMaven · org.keycloak:keycloak-core · fixed in 24.0.7
- CVE-2024-45294`org.hl7.fhir.core` XXE vulnerability in XSLT transformsMaven · ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 +4 · fixed in 6.3.23
- CVE-2024-45758H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command exMaven · ai.h2o:h2o-core
- CVE-2024-8391Eclipse Vert.x gRPC server does not limit the maximum message sizeMaven · io.vertx:vertx-grpc-client, io.vertx:vertx-grpc-server · fixed in 4.5.10
- CVE-2024-4629Keycloak: potential bypass of brute force protectionMaven · org.keycloak:keycloak-services · fixed in 22.0.12, 24.0.7, 25.0.4
- CVE-2024-8285Kroxylicious: missing upstream kafka tls hostname verificationMaven · io.kroxylicious:kroxylicious-runtime · fixed in 0.8.0
- CVE-2024-38807CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's LoaderMaven · org.springframework.boot:spring-boot-loader, org.springframework.boot:spring-boot-loader-classic · fixed in 2.7.22, 3.0.17, 3.1.13 and more
- CVE-2024-7885Undertow: improper state management in proxy protocol parsing causes information leakageMaven · io.undertow:undertow-core · fixed in 2.2.36.Final, 2.3.17.Final
- CVE-2023-49198Apache SeaTunnel Web: Arbitrary file read vulnerabilityMaven · org.apache.seatunnel:seatunnel · fixed in 1.0.1
- CVE-2024-22281Apache Helix Front (UI): Helix front hard-coded secret in the express-sessionMaven · org.apache.helix:helix
- CVE-2024-43397Potential unauthorized access issue in apollo-portalMaven · com.ctrip.framework.apollo:apollo · fixed in 2.3.0
- CVE-2024-43202Apache DolphinScheduler: Remote Code Execution VulnerabilityMaven · org.apache.dolphinscheduler:dolphinscheduler-task-api · fixed in 3.2.2
- CVE-2024-38808CVE-2024-38808: Spring Expression DoS VulnerabilityMaven · org.springframework:spring-expression · fixed in 5.3.39
- CVE-2024-38810Missing Authorization When Using @AuthorizeReturnObjectMaven · org.springframework.security:spring-security-core · fixed in 6.3.2
- CVE-2024-43400XWiki Platform allows XSS through XClass name in string propertiesMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.21, 15.5.5, 15.10.6 and more
- CVE-2024-43401In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 15.10-rc-1
- CVE-2024-44076In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.Maven · io.github.microcks:microcks-app · fixed in 1.10.0
- CVE-2024-42850An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.Maven · org.silverpeas.core:silverpeas-core
- CVE-2024-42681Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.Maven · com.xuxueli:xxl-job-core · fixed in 2.4.2
- CVE-2024-41909Apache MINA SSHD: integrity check bypassMaven · org.apache.sshd:sshd-common · fixed in 2.12.0