Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-42469CometVisu Backend for openHAB affected by RCE through path traversalMaven · org.openhab.ui.bundles:org.openhab.ui.cometvisu · fixed in 4.2.1
- CVE-2024-42468Path traversal (CometVisu)Maven · org.openhab.ui.bundles:org.openhab.ui.cometvisu · fixed in 4.2.1
- CVE-2024-42467CometVisu Backend for openHAB affected by SSRF/XSSMaven · org.openhab.ui.bundles:org.openhab.ui.cometvisu · fixed in 4.2.1
- CVE-2024-42470CometVisu Backend for openHAB has a sensitive information disclosure vulnerabilityMaven · org.openhab.ui.bundles:org.openhab.ui.cometvisu · fixed in 4.2.1
- CVE-2024-30188Apache DolphinScheduler: Resource File Read And Write VulnerabilityMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.2
- CVE-2024-29831Apache DolphinScheduler: RCE by arbitrary js executionMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.2
- CVE-2024-43045Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.452.4, 2.462.1, 2.471
- CVE-2024-43044Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system byMaven · org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:remoting · fixed in 2.452.4, 2.462.1, 2.471 and more
- CVE-2024-36268Apache InLong TubeMQ Client: Remote Code Execution vulnerabilityMaven · org.apache.inlong:tubemq-core · fixed in 1.13.0
- CVE-2024-27182Apache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerabilityMaven · org.apache.linkis:linkis · fixed in 1.6.0
- CVE-2024-27181Apache Linkis Basic management services: Privilege Escalation Attack vulnerabilityMaven · org.apache.linkis:linkis · fixed in 1.6.0
- CVE-2024-41948biscuit-java vulnerable to public key confusion in third party blockMaven · org.biscuitsec:biscuit · fixed in 4.0.0
- CVE-2024-23444Elasticsearch elasticsearch-certutil csr fails to encrypt private keyMaven · org.elasticsearch:elasticsearch · fixed in 8.13.0, 7.17.23
- CVE-2024-41947XWiki Platform XSS through conflict resolutionMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 15.10.8, 16.3.0-rc-1
- CVE-2024-37901XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheetMaven · org.xwiki.platform:xwiki-platform-search-ui · fixed in 14.10.21, 15.5.5, 15.10.2
- CVE-2024-37900XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploaderMaven · org.xwiki.platform:xwiki-platform-web-war · fixed in 14.10.21, 15.5.5, 15.10.6 and more
- CVE-2024-37898XWiki Platform vulnerable to document deletion and overwrite from editMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.21, 15.5.5, 15.10.6
- CVE-2023-48396Apache SeaTunnel Web: Authentication bypassMaven · org.apache.seatunnel:seatunnel-web · fixed in 1.0.1
- CVE-2024-40094GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of serMaven · com.graphql-java:graphql-java · fixed in 19.11, 20.9, 21.5
- CVE-2023-49921An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level.Maven · org.elasticsearch:elasticsearch · fixed in 7.17.16, 8.11.2
- CVE-2024-37084CVE-2024-37084: Remote code execution in Spring Cloud Data FlowMaven · org.springframework.cloud:spring-cloud-skipper · fixed in 2.11.4
- CVE-2024-41667OpenAM FreeMarker template injectionMaven · org.openidentityplatform.openam:openam-oauth2 · fixed in 15.0.4
- CVE-2023-48362Apache Drill: XXE Vulnerability in XML Format ReaderMaven · org.apache.drill.exec:drill-java-exec · fixed in 1.21.2
- CVE-2024-39676Apache Pinot: Unauthorized endpoint exposed sensitive informationMaven · org.apache.pinot:pinot-controller · fixed in 1.0.0
- CVE-2024-25638DNSJava DNSSEC BypassMaven · dnsjava:dnsjava · fixed in 3.6.0
- CVE-2024-38503Apache Syncope: HTML tags can be injected into Console or Enduser text fieldsMaven · org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui, org.apache.syncope.client.idrepo:syncope-client-idrepo-console · fixed in 3.0.8
- CVE-2024-23321Apache RocketMQ: Unauthorized Exposure of Sensitive DataMaven · org.apache.rocketmq:rocketmq-all · fixed in 5.3.0
- CVE-2024-6960H2O deserializes ML models without filtering, potentially allowing execution of malicious codeMaven · ai.h2o:h2o-core
- CVE-2024-41172Apache CXF: Unrestricted memory consumption in CXF HTTP clientsMaven · org.apache.cxf:cxf-rt-transports-http · fixed in 4.0.5, 3.6.4
- CVE-2024-32007Apache CXF Denial of Service vulnerability in JOSEMaven · org.apache.cxf:cxf-rt-rs-security-jose · fixed in 4.0.5, 3.6.4, 3.5.9