Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-23634GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store APIMaven · org.geoserver:gs-restconfig · fixed in 2.23.5, 2.24.2
- CVE-2023-51445GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources APIMaven · org.geoserver:gs-restconfig · fixed in 2.23.3
- CVE-2023-51444GeoServer arbitrary file upload vulnerability in REST Coverage Store APIMaven · org.geoserver:gs-platform, org.geoserver:gs-restconfig · fixed in 2.23.4, 2.24.1
- CVE-2023-41877GeoServer log file path traversal vulnerabilityMaven · org.geoserver:gs-main
- CVE-2024-22258CVE-2024-22258: PKCE Downgrade in Spring Authorization ServerMaven · org.springframework.security:spring-security-oauth2-authorization-server · fixed in 1.1.6, 1.2.3
- CVE-2024-27439Apache Wicket: Possible bypass of CSRF protectionMaven · org.apache.wicket:wicket · fixed in 9.17.0, 10.0.0
- CVE-2024-24683Apache Hop Engine: ID isn't escaped when generating HTMLMaven · org.apache.hop:hop · fixed in 2.8.0
- CVE-2024-24042Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirMaven · net.devtech:arrp · fixed in 0.8.2
- CVE-2024-22257In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, vMaven · org.springframework.security:spring-security-core · fixed in 5.7.12, 5.8.11, 6.1.8 and more
- CVE-2024-28128Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execuMaven · org.fitnesse:fitnesse · fixed in 20220319
- CVE-2024-28125FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.Maven · org.fitnesse:fitnesse
- CVE-2024-22259CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)Maven · org.springframework:spring-web · fixed in 6.1.5, 6.0.18, 5.3.33
- CVE-2024-28848SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadataMaven · org.open-metadata:openmetadata-service · fixed in 1.2.4
- CVE-2024-28847SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadataMaven · org.open-metadata:openmetadata-service · fixed in 1.2.4
- CVE-2024-28253SpEL Injection in `PUT /api/v1/policies` in OpenMetadataMaven · org.open-metadata:openmetadata-service · fixed in 1.3.1
- CVE-2024-28752Apache CXF SSRF Vulnerability using the Aegis databindingMaven · org.apache.cxf:cxf-rt-databinding-aegis · fixed in 3.5.8, 3.6.3, 4.0.4
- CVE-2024-23944Apache ZooKeeper: Information disclosure in persistent watcher handlingMaven · org.apache.zookeeper:zookeeper · fixed in 3.8.4, 3.9.2
- CVE-2024-23672Apache Tomcat: WebSocket DoS with incomplete closing handshakeMaven · org.apache.tomcat.embed:tomcat-embed-websocket, org.apache.tomcat:tomcat-websocket · fixed in 11.0.0-M17, 10.1.19, 9.0.86 and more
- CVE-2024-24549Apache Tomcat: HTTP/2 header handling DoSMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 8.5.99, 9.0.86, 10.1.19 and more
- CVE-2024-1979Quarkus: information leak in annotationMaven · io.quarkus:quarkus-kubernetes-deployment · fixed in 3.7.3
- CVE-2024-27894Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS ProxyingMaven · org.apache.pulsar:pulsar-functions-worker · fixed in 2.10.6, 2.11.4, 3.0.3 and more
- CVE-2024-27317Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File ModificationMaven · org.apache.pulsar:pulsar-functions-worker · fixed in 2.10.6, 2.11.4, 3.0.3 and more
- CVE-2024-27135Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionMaven · org.apache.pulsar:pulsar-functions-worker · fixed in 2.10.6, 2.11.4, 3.0.3 and more
- CVE-2022-34321Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics EndpointMaven · org.apache.pulsar:pulsar-proxy · fixed in 2.10.6, 2.11.3, 3.0.2 and more
- CVE-2024-28098Apache Pulsar: Improper Authorization For Topic-Level Policy ManagementMaven · org.apache.pulsar:pulsar-broker · fixed in 3.2.1, 3.1.3, 3.0.3 and more
- CVE-2024-28213nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbiMaven · org.ngrinder:ngrinder-core · fixed in 3.5.9
- CVE-2024-28162In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate vMaven · org.jenkins-ci.plugins:delphix · fixed in 3.1.1
- CVE-2024-28161In Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control TowMaven · org.jenkins-ci.plugins:delphix · fixed in 3.0.2
- CVE-2024-28160Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scriptingMaven · org.jenkins-ci.plugins:icescrum
- CVE-2024-28159A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permissionMaven · org.jenkins-ci.plugins:svn-partial-release-mgr