Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-5273Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing Maven · org.jenkins-ci.plugins:report-info
- CVE-2024-5165Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of InputMaven · org.eclipse.ditto:ditto · fixed in 3.4.5, 3.5.6
- CVE-2024-29392Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.Maven · org.silverpeas.core:silverpeas-core
- CVE-2024-32888Amazon JDBC Driver for Redshift SQL Injection via line comment generationMaven · com.amazon.redshift:redshift-jdbc42 · fixed in 2.1.0.28
- CVE-2024-28087In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability.Maven · org.bonitasoft.engine:bonita-server · fixed in 10.1.0.W11
- CVE-2024-3462Authorization bypass in Ant Media ServerMaven · io.antmedia:ant-media-server
- CVE-2024-4701Path Traversal vulnerability via File Uploads in GenieMaven · com.netflix.genie:genie-web · fixed in 4.3.18
- CVE-2024-34365Apache Karaf Cave: Cave SSRF and arbitrary file accessMaven · org.apache.karaf:cave
- CVE-2024-29857An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA beforeMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk14 +6 · fixed in 1.0.2.5, 1.78
- CVE-2024-30171An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15on +6 · fixed in 1.78, 1.0.19
- CVE-2024-30172An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15to18 +4 · fixed in 1.78
- CVE-2024-26579Apache Inlong JDBC VulnerabilityMaven · org.apache.inlong:manager-pojo · fixed in 1.12.0
- CVE-2024-4536Eclipse EDC: OAuth2 Credential Exfiltration VulnerabilityMaven · org.eclipse.edc:connector-core · fixed in 0.6.3
- CVE-2024-33748Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier.Maven · net.mingsoft:ms-basic
- CVE-2024-34517The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin acceMaven · org.neo4j:neo4j-cypher · fixed in 5.19.0
- CVE-2023-35701Apache Hive: Arbitrary command execution via JDBC driverMaven · org.apache.hive:hive-jdbc · fixed in 4.0.0
- CVE-2024-34447An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.Maven · org.bouncycastle:bcprov-jdk12, org.bouncycastle:bcprov-jdk14 +5 · fixed in 1.78, 2.73.6, 1.0.19
- CVE-2024-4029Wildfly: no timeout for eap management interface may lead to denial of service (dos)Maven · org.wildfly:wildfly-domain-http
- CVE-2024-34148Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is Maven · org.jenkins-ci.plugins:partial-release-manager
- CVE-2024-34147Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins contMaven · org.jenkins-ci.plugins:telegrambot
- CVE-2024-34146Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, aMaven · org.jenkins-ci.plugins:git-server · fixed in 117.veb
- CVE-2024-34145A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script SecurityMaven · org.jenkins-ci.plugins:script-security · fixed in 1336.vf33a
- CVE-2024-34144A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allowsMaven · org.jenkins-ci.plugins:script-security · fixed in 1336.vf33a
- CVE-2024-32114Apache ActiveMQ: Jolokia and REST API were not secured with default configurationMaven · org.apache.activemq:apache-activemq · fixed in 6.1.2
- CVE-2024-1726Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of serviceMaven · io.quarkus.resteasy.reactive:resteasy-reactive · fixed in 3.8.0, 3.7.4, 3.2.11.Final
- CVE-2024-1102Jberet: jberet-core logging database credentialsMaven · org.jberet:jberet-core · fixed in 2.2.1.Final
- CVE-2023-6787Keycloak: session hijacking via re-authenticationMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2023-6717Keycloak: xss via assertion consumer service url in saml post-binding flowMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2023-6544Keycloak: authorization bypassMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2023-6484Keycloak: log injection during webauthn authentication or registrationMaven · org.keycloak:keycloak-services · fixed in 22.0.9, 23.0.5