Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-5675Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or…Maven · io.quarkus:quarkus-resteasy-reactive-common, io.quarkus:quarkus-resteasy-reactive-common-deployment · fixed in 3.2.10.Final, 3.6.9, 3.7.1
- CVE-2023-3597Keycloak: secondary factor bypass in step-up authenticationMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2024-32656Ant Media Server vulnerable to local privilege escalationMaven · io.antmedia:ant-media-server · fixed in 2.9.0
- CVE-2024-27349Apache HugeGraph-Server: Bypass whitelist in Auth modeMaven · org.apache.hugegraph:hugegraph-api · fixed in 1.3.0
- CVE-2024-27348Apache HugeGraph-Server: Command execution in gremlinMaven · org.apache.hugegraph:hugegraph-api, org.apache.hugegraph:hugegraph-core · fixed in 1.3.0
- CVE-2024-27347Apache HugeGraph-Hubble: SSRF in Hubble connection pageMaven · org.apache.hugegraph:hugegraph-hubble · fixed in 1.3.0
- CVE-2024-3825CSRF in BlazeMeter Jenkins plugin Maven · com.blazemeter.plugins:blazemeterjenkinsplugin · fixed in 4.22
- CVE-2024-2419Keycloak: path traversal in the redirect validationMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2024-1249Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddosMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2024-1132Keycloak: path transversal in redirection validationMaven · org.keycloak:keycloak-services · fixed in 22.0.10, 24.0.3
- CVE-2024-22262CVE-2024-22262: Spring Framework URL Parsing with Host ValidationMaven · org.springframework:spring-web · fixed in 5.3.34, 6.0.19, 6.1.6
- CVE-2024-27309Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft modeMaven · org.apache.kafka:kafka-metadata · fixed in 3.6.2
- CVE-2024-31997XWiki Platform remote code execution from account through UIExtension parametersMaven · org.xwiki.platform:xwiki-platform-uiextension-api · fixed in 14.10.19, 15.5.4, 15.9-rc-1
- CVE-2024-31996XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionMaven · org.xwiki.commons:xwiki-commons-velocity · fixed in 14.10.19, 15.5.4, 15.9-rc-1
- CVE-2024-31988XWiki Platform CSRF remote code execution through the realtime HTML Converter APIMaven · org.xwiki.platform:xwiki-platform-realtime-ui · fixed in 14.10.19, 15.5.4, 15.9
- CVE-2024-31987XWiki Platform remote code execution from account via custom skins supportMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.19, 15.5.4, 15.10-rc-1
- CVE-2024-31986XWiki Platform CSRF remote code execution through scheduler job's document referenceMaven · org.xwiki.platform:xwiki-platform-scheduler-ui · fixed in 14.10.19, 15.5.4, 15.9
- CVE-2024-31985XWiki Platform CSRF in the job schedulerMaven · org.xwiki.platform:xwiki-platform-scheduler-ui · fixed in 14.10.19, 15.5.4, 15.9
- CVE-2024-31984XWiki Platform: Remote code execution through space title and Solr space facetMaven · org.xwiki.platform:xwiki-platform-search-solr-ui · fixed in 14.10.20, 15.5.4, 15.10-rc-1
- CVE-2024-31983XWiki Platform: Remote code execution from edit in multilingual wikis via translationsMaven · org.xwiki.platform:xwiki-platform-localization-source-wiki · fixed in 14.10.20, 15.5.4, 15.10-rc-1
- CVE-2024-31982XWiki Platform: Remote code execution as guest via DatabaseSearchMaven · org.xwiki.platform:xwiki-platform-search-ui · fixed in 14.10.20, 15.5.4, 15.10-rc-1
- CVE-2024-31981XWiki Platform: Privilege escalation (PR) from user registration through PDFClassMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.20, 15.5.4, 15.10-rc-1
- CVE-2024-31465XWiki Platform: Remote code execution from account via SearchSuggestSourceSheetMaven · org.xwiki.platform:xwiki-platform-search-ui · fixed in 14.10.20, 15.5.4, 15.10-rc-1
- CVE-2024-31464XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deletedMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.19, 15.5.4, 15.9-rc-1
- CVE-2023-6236Eap: oidc app attempting to access the second tenant, the user should be prompted to logMaven · org.wildfly.security:wildfly-elytron-http-oidc · fixed in 2.2.5.Final
- CVE-2024-31867Apache Zeppelin: LDAP search filter query Injection VulnerabilityMaven · org.apache.zeppelin:zeppelin-server · fixed in 0.11.1
- CVE-2024-31868Apache Zeppelin: XSS vulnerability in the helium moduleMaven · org.apache.zeppelin:zeppelin-interpreter · fixed in 0.11.1
- CVE-2024-31866Apache Zeppelin: Interpreter download command does not escape malicious code injectionMaven · org.apache.zeppelin:zeppelin-interpreter · fixed in 0.11.1
- CVE-2024-31865Apache Zeppelin: Cron arbitrary user impersonation with improper privilegesMaven · org.apache.zeppelin:zeppelin-server · fixed in 0.11.1
- CVE-2024-31864Apache Zeppelin: Remote code execution by adding malicious JDBC connection stringMaven · org.apache.zeppelin:zeppelin-jdbc · fixed in 0.11.1