Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-25605The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp17, 7.4.3.5-ga5
- CVE-2024-25604Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix packMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp17, 7.4.3.5-ga5
- CVE-2024-25150Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and LiferayMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp19, 7.3.10.u4, 7.4.3.4-ga4
- CVE-2024-22234CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticatedMaven · org.springframework.security:spring-security-core · fixed in 6.1.7, 6.2.2
- CVE-2024-25149Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and oMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp15, 7.4.2-ga3
- CVE-2023-44308Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allowsMaven · com.liferay:com.liferay.adaptive.media.web · fixed in 2023.Q3.6
- CVE-2023-5190Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 202Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2023.Q3.6, 7.4.3.102-ga102
- CVE-2021-29038Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and olderMaven · com.liferay.commerce:com.liferay.commerce.account.web, com.liferay.portal:portal-impl +3 · fixed in 3.0.7, 5.18.4, 7.2.10.fp17 and more
- CVE-2021-29050Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service Maven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom · fixed in 5.25.0, 7.2.10.fp11
- CVE-2022-45320Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticaMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.16
- CVE-2024-1635Undertow: out-of-memory error after several closed connections with wildfly-http-client protocolMaven · io.undertow:undertow-core · fixed in 2.3.12.Final, 2.2.31.Final
- CVE-2024-1597pgjdbc SQL Injection via line comment generationMaven · org.postgresql:postgresql · fixed in 42.2.28, 42.3.9, 42.4.4 and more
- CVE-2024-25710Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP fileMaven · org.apache.commons:commons-compress · fixed in 1.26.0
- CVE-2024-26308Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 fileMaven · org.apache.commons:commons-compress · fixed in 1.26.0
- CVE-2024-20925Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX).Maven · org.openjfx:javafx-media · fixed in 17.0.10, 21.0.2
- CVE-2023-45860In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector.Maven · com.hazelcast:hazelcast, com.hazelcast:hazelcast-enterprise · fixed in 5.3.5, 5.2.5
- CVE-2024-25125Absolute path traversal vulnerability in digdag serverMaven · io.digdag:digdag-server · fixed in 0.10.5.1
- CVE-2024-1459Undertow: directory traversal vulnerabilityMaven · io.undertow:undertow-core · fixed in 2.2.31.Final, 2.3.12.Final
- CVE-2024-23833OpenRefine JDBC Attack VulnerabilityMaven · org.openrefine:database · fixed in 3.7.8
- CVE-2023-52428In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header valMaven · com.nimbusds:nimbus-jose-jwt · fixed in 9.37.2
- CVE-2024-21490This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.Maven · org.webjars.bower:angular, org.webjars.npm:angular
- CVE-2023-50291Apache Solr: System Property redaction logic inconsistency can lead to leaked passwordsMaven · org.apache.solr:solr-core · fixed in 8.11.3, 9.3.0
- CVE-2023-50292Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated usersMaven · org.apache.solr:solr-core · fixed in 9.3.0, 8.11.3
- CVE-2023-50298Apache Solr: Solr can expose ZooKeeper credentials via Streaming ExpressionsMaven · org.apache.solr:solr-solrj, org.apache.solr:solr-solrj-streaming · fixed in 9.4.1, 8.11.3
- CVE-2023-50386Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsMaven · org.apache.solr:solr-core · fixed in 8.11.3, 9.4.1
- CVE-2024-23639micronaut-core management endpoints vulnerable to drive-by localhost attackMaven · io.micronaut:micronaut-http-server, io.micronaut:micronaut-http-server-netty +1 · fixed in 3.8.3
- CVE-2024-25148In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, anMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp15, 7.3.10.u4, 7.4.2
- CVE-2024-25146Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and oMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u4, 7.2.10.fp18, 7.4.2
- CVE-2024-25144The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 beforeMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp19, 7.3.10.u6, 7.4.13.u27 and more
- CVE-2023-47798Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsuMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.2.10.fp5, 7.3.1