Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-24113xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.Maven · com.xuxueli:xxl-job
- CVE-2024-24824graylog2-server vulnerable to instantiation of arbitrary classes triggered by API requestMaven · org.graylog2:graylog2-server · fixed in 5.1.11, 5.2.4
- CVE-2024-24823graylog2-server Session Fixation vulnerability through cookie injectionMaven · org.graylog2:graylog2-server · fixed in 5.1.11, 5.2.4
- CVE-2024-25145Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, anMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.3.13u8, 7.3.10.u4, 7.2.10.fp17 and more
- CVE-2024-25143The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service packMaven · com.liferay.portal:release.portal.bom · fixed in 7.3.7
- CVE-2023-39196Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpointsMaven · org.apache.ozone:ozone-main · fixed in 1.4.0
- CVE-2023-51437Apache Pulsar: Timing attack in SASL token signature verificationMaven · org.apache.pulsar:pulsar-broker-auth-sasl · fixed in 2.11.3, 3.0.2, 3.1.1
- CVE-2024-23673Apache Sling Servlets Resolver: Malicious code execution via path traversalMaven · org.apache.sling:org.apache.sling.servlets.resolver · fixed in 2.11.0
- CVE-2023-34042The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be wriMaven · org.springframework.security:spring-security-config · fixed in 6.1.4, 6.0.7, 5.8.7 and more
- CVE-2024-22567File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.Maven · net.mingsoft:ms-mcms
- CVE-2024-23635AntiSamy malicious input can provoke XSS when preserving commentsMaven · org.owasp.antisamy:antisamy · fixed in 1.7.5
- CVE-2024-1143Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and sMaven · com.linecorp.centraldogma:centraldogma-server · fixed in 0.64.1
- CVE-2024-22533Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability.Maven · com.ibeetl:beetl-core · fixed in 3.15.13.RELEASE
- CVE-2024-22236In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution iMaven · org.springframework.cloud:spring-cloud-contract-shade · fixed in 4.1.1, 4.0.5, 3.1.10
- CVE-2024-24565CrateDB database has an arbitrary file read vulnerabilityMaven · io.crate:crate · fixed in 5.3.9, 5.4.8, 5.5.4 and more
- CVE-2023-51982CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component.Maven · io.crate:crate · fixed in 5.2.11, 5.3.8, 5.4.7 and more
- CVE-2023-29055Apache Kylin: Insufficiently protected credentials in config fileMaven · org.apache.kylin:kylin-core-common · fixed in 4.0.4
- CVE-2023-6291Keycloak: redirect_uri validation bypassMaven · org.keycloak:keycloak-services · fixed in 23.0.3
- CVE-2023-6267Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.Maven · io.quarkus.resteasy.reactive:resteasy-reactive · fixed in 2.13.9.Final, 3.2.9.Final
- CVE-2024-23905Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generateMaven · io.jenkins.plugins:redhat-dependency-analytics · fixed in 0.9.0
- CVE-2024-23904Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a fMaven · org.jenkins-ci.plugins:log-command
- CVE-2024-23903Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the pMaven · io.jenkins.plugins:gitlab-branch-source · fixed in 688.v5fa
- CVE-2024-23902A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers toMaven · io.jenkins.plugins:gitlab-branch-source · fixed in 688.v5fa
- CVE-2024-23901Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured oMaven · io.jenkins.plugins:gitlab-branch-source · fixed in 688.v5fa
- CVE-2024-23900Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, alloMaven · org.jenkins-ci.plugins:matrix-project · fixed in 822.824.v14451b
- CVE-2024-23899Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character fMaven · org.jenkins-ci.plugins:git-server · fixed in 99.101.v720e86326c09
- CVE-2024-23898Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests maMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.426.3, 2.442
- CVE-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.426.3, 2.440.1, 2.442
- CVE-2024-23636SOFARPC Remote Command Execution(RCE) VulnerbilityMaven · com.alipay.sofa:rpc-sofa-boot-starter · fixed in 5.12.0
- CVE-2024-22490Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.Maven · com.ibeetl:beetl