Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-22243CVE-2024-22243: Spring Framework URL Parsing with Host ValidationMaven · org.springframework:spring-web · fixed in 6.1.4, 6.0.17, 5.3.32
- CVE-2024-26138License information is public, exposing instance id and license holder detailsMaven · com.xwiki.licensing:application-licensing-licensor-ui · fixed in 1.24.2
- CVE-2023-47795Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q3.6, 7.4.3.102
- CVE-2024-25151The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 beMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u4, 7.2.10.fp15, 7.4.3.4
- CVE-2023-40191Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and LiMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q3.6, 7.4.3.98
- CVE-2023-42498Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and LifeMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q3.5, 7.4.3.98
- CVE-2024-26269Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.13.u38, 7.3.10.u11, 7.2.10.fp20 and more
- CVE-2024-26266Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and LifMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.13.u10, 7.3.10.u4, 7.2.10.fp17 and more
- CVE-2023-42496Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and LiferayMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u34, 2023.Q3.6, 7.4.3.98
- CVE-2024-25603Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and olMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u4, 7.2.10.fp17, 7.4.3.5
- CVE-2024-25152Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versionMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u4, 7.2.10.fp17
- CVE-2024-25601Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and oldMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u4, 7.2.10.fp17
- CVE-2024-25602Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsuMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u4, 7.2.10.fp17
- CVE-2024-25147Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, andMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u4, 7.2.10.fp15
- CVE-2024-26140com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement BrowserMaven · com.yetanalytics:lrs · fixed in 1.2.17
- CVE-2024-23114Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepositoryMaven · org.apache.camel:camel-cassandraql · fixed in 3.21.4, 3.22.1, 4.0.4 and more
- CVE-2024-22369Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepositoryMaven · org.apache.camel:camel-sql · fixed in 3.21.4, 3.22.1, 4.0.4 and more
- CVE-2024-26270The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q3.5, 7.4.3.100
- CVE-2024-26268User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 2Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp20, 7.3.10.u8, 7.4.13.u27 and more
- CVE-2024-26267In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 befMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp19, 7.3.10.u5, 7.4.13.u26 and more
- CVE-2024-26265The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.16
- CVE-2024-25610In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 befoMaven · com.liferay.portal:com.liferay.portal.web, com.liferay.portal:release.dxp.bom +1 · fixed in 5.0.96, 7.4.13.u9, 7.3.10.u4 and more
- CVE-2023-51770Apache DolphinScheduler: Arbitrary File Read VulnerabilityMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.1
- CVE-2023-50270Apache DolphinScheduler: Session do not expire after password changeMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.1
- CVE-2023-49250Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtilMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.1
- CVE-2023-49109Remote Code Execution in Apache DolphinschedulerMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.1
- CVE-2024-25609HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 sMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.13.u9, 7.4.3.13-ga13
- CVE-2024-25608HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp19, 7.3.10.u4, 7.4.13.u19 and more
- CVE-2024-25607The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and LifeMaven · com.liferay.portal:com.liferay.portal.kernel, com.liferay.portal:release.dxp.bom +1 · fixed in 38.0.0, 7.3.10.u4, 7.2.10.fp17 and more
- CVE-2024-25606XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before uMaven · com.liferay.portal:com.liferay.util.java, com.liferay.portal:release.dxp.bom +1 · fixed in 14.0.0, 7.3.10.u12, 7.4.13.u4 and more