Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-31863Apache Zeppelin: Replacing other users notebook, bypassing any permissionsMaven · org.apache.zeppelin:zeppelin-server · fixed in 0.11.0
- CVE-2024-3046In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unautheMaven · org.eclipse.kura:org.eclipse.kura.web2
- CVE-2024-31862Apache Zeppelin: Denial of service with invalid notebook nameMaven · org.apache.zeppelin:zeppelin-server · fixed in 0.11.0
- CVE-2022-47894Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXEMaven · org.apache.zeppelin:sap · fixed in 0.11.0
- CVE-2021-28656Apache Zeppelin: CSRF vulnerability in the Credentials pageMaven · org.apache.zeppelin:zeppelin-web
- CVE-2024-31860Apache Zeppelin: Path traversal vulnerabilityMaven · org.apache.zeppelin:zeppelin-server · fixed in 0.11.0
- CVE-2024-1233Eap: wildfly-elytron has a ssrf security issueMaven · org.wildfly.security:wildfly-elytron-realm-token
- CVE-2024-3366Xuxueli xxl-job Template JdkSerializeTool.java deserialize injectionMaven · com.xuxueli:xxl-job-core
- CVE-2024-2700Quarkus-core: leak of local configuration properties into quarkus applicationsMaven · io.quarkus:quarkus-core · fixed in 3.9.2, 3.8.4, 3.2.12.Final
- CVE-2024-29834Apache Pulsar: Improper Authorization For Namespace and Topic Management EndpointsMaven · org.apache.pulsar:pulsar-broker · fixed in 3.0.4, 3.2.2
- CVE-2024-1300Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportMaven · io.vertx:vertx-core · fixed in 4.4.8, 4.5.3
- CVE-2024-27609Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel.Maven · org.bonitasoft.console:bonita-web-server, org.bonitasoft.platform:platform-resources · fixed in 10.1.0.W11
- CVE-2024-23449Elasticsearch Uncaught ExceptionMaven · org.elasticsearch:elasticsearch · fixed in 8.11.1
- CVE-2024-28109Potential XSLT injection vulnerability when using policy filesMaven · org.verapdf:core, org.verapdf:core-arlington +7 · fixed in 1.24.2, 1.25.127
- CVE-2024-23451Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security modelMaven · org.elasticsearch:elasticsearch · fixed in 8.13.0
- CVE-2024-23450Elasticsearch Uncontrolled Resource Consumption vulnerabilityMaven · org.elasticsearch:elasticsearch · fixed in 7.17.19, 8.13.0
- CVE-2024-1023Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxMaven · io.vertx:vertx-core · fixed in 4.5.2, 4.4.7
- CVE-2024-25420An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system…Maven · org.igniterealtime.openfire:xmppserver · fixed in 4.8.1
- CVE-2024-25421An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.Maven · org.igniterealtime.openfire:xmppserver · fixed in 4.8.1
- CVE-2024-29025Netty HttpPostRequestDecoder can OOMMaven · io.netty:netty-codec-http · fixed in 4.1.108.Final
- CVE-2023-5685Xnio: stackoverflowexception when the chain of notifier states becomes problematically bigMaven · org.jboss.xnio:xnio-api · fixed in 3.8.14.Final
- CVE-2024-29131Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()Maven · org.apache.commons:commons-configuration2 · fixed in 2.10.1
- CVE-2024-29133Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object treeMaven · org.apache.commons:commons-configuration2 · fixed in 2.10.1
- CVE-2022-4963Folio Spring Module Core Schema Name HibernateSchemaService.java dropSchema sql injectionMaven · org.folio:spring-module-core · fixed in 2.0.0
- CVE-2024-23821GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)Maven · org.geoserver:gs-gwc · fixed in 2.24.1, 2.23.4
- CVE-2024-23819GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML PageMaven · org.geoserver.extension:gs-mapml · fixed in 2.23.4, 2.24.1
- CVE-2024-23818GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers FormatMaven · org.geoserver:gs-wms · fixed in 2.23.3, 2.24.1
- CVE-2024-23643GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed FormMaven · org.geoserver:gs-gwc-rest · fixed in 2.23.2, 2.24.1
- CVE-2024-23642GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG RendererMaven · org.geoserver:gs-wms · fixed in 2.23.4, 2.24.1
- CVE-2024-23640GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style PublisherMaven · org.geoserver:gs-main, org.geoserver:gs-ows · fixed in 2.23.3