Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-28158A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers toMaven · org.jenkins-ci.plugins:svn-partial-release-mgr
- CVE-2024-28157Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vMaven · org.jenkins-ci.plugins:gitbucket
- CVE-2024-28156Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-Maven · org.jenkins-ci.plugins:build-monitor-plugin
- CVE-2024-28155Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/ReMaven · com.rapid7:jenkinsci-appspider-plugin · fixed in 1.0.17
- CVE-2024-28154Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by defauMaven · com.sonymobile.jenkins.plugins.mq:mq-notifier · fixed in 1.4.1
- CVE-2024-28153Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in aMaven · org.jenkins-ci.plugins:dependency-check-jenkins-plugin · fixed in 5.4.6
- CVE-2024-28152In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests fMaven · org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source · fixed in 871.v28d74e8b_4226
- CVE-2024-28151Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the conMaven · org.jenkins-ci.plugins:htmlpublisher · fixed in 1.32.1
- CVE-2024-28150Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frMaven · org.jenkins-ci.plugins:htmlpublisher · fixed in 1.32.1
- CVE-2024-28149Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure peMaven · org.jenkins-ci.plugins:htmlpublisher · fixed in 1.32.1
- CVE-2024-2216A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permiMaven · org.jenkins-ci.plugins:docker-build-step
- CVE-2024-2215A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attMaven · org.jenkins-ci.plugins:docker-build-step
- CVE-2023-50740Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedMaven · org.apache.linkis:linkis · fixed in 1.5.0
- CVE-2024-26580Apache InLong: Logged-in user could exploit an arbitrary file read vulnerabilityMaven · org.apache.inlong:manager-common · fixed in 1.11.0
- CVE-2024-27138Apache Archiva: disabling user registration is not effectiveMaven · org.apache.archiva:archiva
- CVE-2024-27139Apache Archiva: incorrect authentication potentially leading to account takeoverMaven · org.apache.archiva:archiva
- CVE-2024-27140Apache Archiva: reflected XSSMaven · org.apache.archiva:archiva-common
- CVE-2023-50378Apache Ambari: Various XSS problemsMaven · org.apache.ambari:ambari · fixed in 2.7.8
- CVE-2024-22871An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__59Maven · org.clojure:clojure · fixed in 1.11.2, 1.12.0-alpha9
- CVE-2023-45859In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client Maven · com.hazelcast:hazelcast, com.hazelcast:hazelcast-all · fixed in 5.2.5, 5.3.5
- CVE-2024-1722Keycloak-core: dos via account lockoutMaven · org.keycloak:keycloak-services · fixed in 24.0.0
- CVE-2023-50380Apache Ambari: authenticated users could perform XXE to read arbitrary files on the serverMaven · org.apache.ambari.contrib.views:wfmanager · fixed in 2.7.8
- CVE-2024-21742Apache James Mime4J: Mime4J DOM header injectionMaven · org.apache.james:apache-mime4j-core · fixed in 0.8.10
- CVE-2023-51747SMTP smuggling in Apache JamesMaven · org.apache.james:james-server · fixed in 3.7.5, 3.8.1
- CVE-2023-51518Apache James server: Privilege escalation via JMX pre-authentication deserialisationMaven · org.apache.james:james-server · fixed in 3.7.5, 3.8.1
- CVE-2023-50379Apache Ambari: authenticated users could perform command injection to perform RCEMaven · org.apache.ambari.contrib.views:ambari-contrib-views · fixed in 2.7.8
- CVE-2024-22201Jetty connection leaking on idle timeout when TCP congestedMaven · org.eclipse.jetty.http2:http2-common, org.eclipse.jetty.http2:jetty-http2-common +2 · fixed in 9.4.54, 10.0.20, 11.0.20 and more
- CVE-2024-22371Apache Camel issue on ExchangeCreatedEventMaven · org.apache.camel:camel-core · fixed in 3.21.4, 3.22.1, 4.0.4 and more
- CVE-2024-1735A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentMaven · com.linecorp.armeria:armeria-saml · fixed in 1.27.2
- CVE-2024-23320Apache DolphinScheduler: Arbitrary js execution as root for authenticated usersMaven · org.apache.dolphinscheduler:dolphinscheduler-master · fixed in 3.2.1