Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-29736Apache CXF: SSRF vulnerability via WADL stylesheet parameterMaven · org.apache.cxf:cxf-rt-rs-service-description · fixed in 4.0.5, 3.6.4, 3.5.9
- CVE-2024-40642Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp Maven · io.netty.incubator:netty-incubator-codec-bhttp · fixed in 0.0.13.Final
- CVE-2024-29178Apache StreamPark: FreeMarker SSTI RCE VulnerabilityMaven · org.apache.streampark:streampark · fixed in 2.1.4
- CVE-2023-7272Eclipse Parsson stack overflow with deeply nested objectsMaven · org.eclipse.parsson:parsson · fixed in 1.1.3, 1.0.4
- CVE-2024-29120Apache StreamPark: Information leakage vulnerabilityMaven · org.apache.streampark:streampark · fixed in 2.1.4
- CVE-2024-31411Apache StreamPipes: Potential remote code execution (RCE) via file uploadMaven · org.apache.streampipes:streampipes-parent · fixed in 0.95.0
- CVE-2024-31979Apache StreamPipes: Possibility of SSRF in pipeline element installation processMaven · org.apache.streampipes:streampipes-parent · fixed in 0.95.0
- CVE-2024-30471Apache StreamPipes: Potential creation of multiple identical accountsMaven · org.apache.streampipes:streampipes-parent · fixed in 0.95.0
- CVE-2024-29737Apache StreamPark (incubating): maven build params could trigger remote command executionMaven · org.apache.streampark:streampark · fixed in 2.1.4
- CVE-2023-52291Apache StreamPark (incubating): Unchecked maven build params could trigger remote command executionMaven · org.apache.streampark:streampark · fixed in 2.1.4
- CVE-2023-49566Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerabilityMaven · org.apache.linkis:linkis-datasource · fixed in 1.6.0
- CVE-2023-46801Apache Linkis DataSource: DataSource Remote code execution vulnerabilityMaven · org.apache.linkis:linkis-datasource · fixed in 1.6.0
- CVE-2023-41916Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file readingMaven · org.apache.linkis:linkis-datasource · fixed in 1.6.0
- CVE-2024-36522Apache Wicket: Remote code execution via XSLT injectionMaven · org.apache.wicket:wicket-util · fixed in 10.1.0, 9.18.0, 8.16.0
- CVE-2024-39900OpenSearch Dashboards Reports does not properly restrict access to private tenant resourcesMaven · org.opensearch.plugin:opensearch-reports-scheduler · fixed in 2.14.0.0
- CVE-2024-39901OpenSearch Observability does not properly restrict access to private tenant resourcesMaven · org.opensearch.plugin:opensearch-observability · fixed in 2.14.0.0
- CVE-2024-22271Spring Cloud Function Web DOS VulnerabilityMaven · org.springframework.cloud:spring-cloud-function-context · fixed in 4.0.8, 4.1.2
- CVE-2024-39031In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar.Maven · org.silverpeas.core:silverpeas-core-rs, org.silverpeas.core:silverpeas-core-web
- CVE-2024-3653Undertow: learningpushhandler can lead to remote memory dos attacksMaven · io.undertow:undertow-core · fixed in 2.3.15.Final, 2.2.34.Final
- CVE-2024-5971Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticketMaven · io.undertow:undertow-core · fixed in 2.3.15.Final, 2.2.34.Final
- CVE-2024-37389Apache NiFi: Improper Neutralization of Input in Parameter Context DescriptionMaven · org.apache.nifi:nifi-web-ui · fixed in 1.27.0, 2.0.0-M4
- CVE-2024-34750Apache Tomcat: HTTP/2 excess header handling DoSMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 11.0.0-M21, 10.1.25, 9.0.90
- CVE-2024-36404GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressionsMaven · org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema +1 · fixed in 30.4, 31.2, 29.6 and more
- CVE-2024-36401Remote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-wfs +1 · fixed in 2.24.4, 2.25.2, 2.23.6 and more
- CVE-2024-34696 GeoServer's Server Status shows sensitive environmental variables and Java propertiesMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-main · fixed in 2.24.4, 2.25.1
- CVE-2024-24749Classpath resource disclosure in GWC Web Resource API on Windows / TomcatMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-gwc · fixed in 2.23.5, 2.24.3
- CVE-2024-38374Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-javaMaven · org.cyclonedx:cyclonedx-core-java · fixed in 9.0.4
- CVE-2024-39460Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL inMaven · org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source · fixed in 887.va
- CVE-2024-39459In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoMaven · org.jenkins-ci.plugins:plain-credentials · fixed in 183.va
- CVE-2024-39458When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnosticMaven · org.jenkins-ci.plugins:structs · fixed in 338.v848422169819