Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-38364DSpace Cross Site Scripting (XSS) via a deposited HTML/XML documentMaven · org.dspace:dspace-server-webapp · fixed in 7.6.2
- CVE-2024-38369XWiki programming rights may be inherited by inclusion Maven · org.xwiki.platform:xwiki-platform-rendering-macro-include · fixed in 15.0-rc-1
- CVE-2024-29868Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token GenerationMaven · org.apache.streampipes:streampipes-resource-management · fixed in 0.95.0
- CVE-2024-27136Apache JSPWiki: Cross-site scripting vulnerability on upload pageMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.12.2
- CVE-2021-47621ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.Maven · io.github.classgraph:classgraph · fixed in 4.8.112
- CVE-2024-37899Disabling a user account changes its author, allowing RCE from user account in XWikiMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.21, 15.5.5, 15.10.6 and more
- CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listenerMaven · io.undertow:undertow-core · fixed in 2.3.14.Final, 2.2.33.Final
- CVE-2024-36117Path traversal while serving Reposilite javadoc expanded filesMaven · com.reposilite:reposilite-backend · fixed in 3.5.12
- CVE-2024-36116Path traversal in Reposilite javadoc file expansionMaven · com.reposilite:reposilite-backend · fixed in 3.5.12
- CVE-2024-36115Stored Cross site scripting in Reposilite artifactsMaven · com.reposilite:reposilite-backend · fixed in 3.5.12
- CVE-2024-5967Keycloak: leak of configured ldap bind credentials through the keycloak admin consoleMaven · org.keycloak:keycloak-ldap-federation · fixed in 25.0.1, 22.0.12, 24.0.6
- CVE-2024-37902Path thraversal in DeepJavaLibraryMaven · ai.djl:api · fixed in 0.28.0
- CVE-2024-36543Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Maven · io.strimzi:strimzi
- CVE-2024-38460In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartexMaven · org.sonarsource.sonarqube:sonar-web · fixed in 9.9.4
- CVE-2024-37280Elasticsearch StackOverflow vulnerabilityMaven · org.elasticsearch:elasticsearch · fixed in 8.14.0
- CVE-2024-37309Client initialized Session-Renegotiation DoSMaven · io.crate:crate · fixed in 5.7.2
- CVE-2024-36265Apache Submarine Server Core: authorization bypassMaven · org.apache.submarine:submarine-server-core
- CVE-2024-36264Apache Submarine Commons Utils: default secretMaven · org.apache.submarine:submarine-commons-utils
- CVE-2024-36263Apache Submarine Server Core: SQL injectionMaven · org.apache.submarine:submarine-server-core
- CVE-2024-35255Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityMaven · com.azure:azure-identity, com.microsoft.azure:msal4j · fixed in 1.12.2, 1.15.1
- CVE-2024-36823The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitiveMaven · org.ninjaframework:ninja-core
- CVE-2024-36121 netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats NoncesMaven · io.netty.incubator:netty-incubator-codec-ohttp · fixed in 0.0.11.Final
- CVE-2024-4540Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookieMaven · org.keycloak:keycloak-services · fixed in 24.0.5
- CVE-2024-36124iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crashMaven · org.iq80.snappy:snappy · fixed in 0.5
- CVE-2024-36042Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticMaven · org.silverpeas.core:silverpeas-core · fixed in 6.3.5
- CVE-2024-5520Cross-Site Scripting stored in Alkacon OpenCMSMaven · org.opencms:opencms-core · fixed in 17.0
- CVE-2024-36114Decompressors can crash the JVM and leak memory content in AircompressorMaven · io.airlift:aircompressor · fixed in 0.27
- CVE-2024-35219OpenAPI Generator Online - Arbitrary File Read/DeleteMaven · org.openapitools:openapi-generator-online · fixed in 7.6.0
- CVE-2023-46442An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).Maven · org.soot-oss:soot · fixed in 4.4.1
- CVE-2024-22588Kwik commit 745fd4e2 does not discard unused encryption keys.Maven · tech.kwik:kwik · fixed in 0.8