Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-22496Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.Maven · com.jfinal:jfinal
- CVE-2024-22497Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crMaven · com.jfinal:jfinal
- CVE-2024-22233CVE-2024-22233: Spring Framework server Web DoS VulnerabilityMaven · org.springframework:spring-core · fixed in 6.1.3, 6.0.16
- CVE-2017-20189In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization.Maven · org.clojure:clojure · fixed in 1.9.0
- CVE-2024-23688Consensys Discovery Nonce ReuseMaven · tech.pegasys.discovery:discovery · fixed in 0.4.5
- CVE-2024-23687FOLIO mod-data-export-spring Hard-Coded CredentialsMaven · org.folio:mod-data-export-spring · fixed in 1.5.4, 2.0.2
- CVE-2024-23686DependencyCheck Debug Mode Logging of NVD API KeyMaven · org.owasp:dependency-check-ant, org.owasp:dependency-check-cli +1 · fixed in 9.0.6
- CVE-2024-23685FOLIO mod-remote-storage Hard Coded CredentialsMaven · org.folio:mod-remote-storage · fixed in 1.7.2, 2.0.3
- CVE-2024-23689ClickHouse Client Certificate Password ExposureMaven · com.clickhouse:clickhouse-client, com.clickhouse:clickhouse-jdbc +1 · fixed in 0.4.6
- CVE-2024-23684upokecenter CBOR Denial of ServiceMaven · com.upokecenter:cbor · fixed in 4.5.1
- CVE-2024-23681Artemis Java Test Sandbox Libary Load EscapeMaven · de.tum.in.ase:artemis-java-test-sandbox · fixed in 1.11.2
- CVE-2024-23683Artemis Java Test Sandbox InvocationTargetException Subclass EscapeMaven · de.tum.in.ase:artemis-java-test-sandbox · fixed in 1.7.6
- CVE-2024-23680AWS Encryption SDK for Java Improper Verification of Cryptographic SignatureMaven · com.amazonaws:aws-encryption-sdk-java · fixed in 2.2.0, 1.9.0
- CVE-2024-23679Enonic XP Session Fixation VulnerabilityMaven · com.enonic.xp:lib-auth · fixed in 7.7.4
- CVE-2024-0758MolecularFaces XSSMaven · de.ipb-halle:molecularfaces · fixed in 0.3.0
- CVE-2024-23682Artemis Java Test Sandbox Class Loading EscapeMaven · de.tum.in.ase:artemis-java-test-sandbox · fixed in 1.8.0
- CVE-2024-21733Apache Tomcat: Leaking of unrelated request bodies in default error pageMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.experimental:tomcat-embed-programmatic +1 · fixed in 8.5.64, 9.0.44
- CVE-2023-51282An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.Maven · net.mingsoft:ms-mcms
- CVE-2024-22491A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameteMaven · com.ibeetl:beetl
- CVE-2023-46226Apache IoTDB: Remote Code Execution (RCE) risk via the UDFMaven · org.apache.iotdb:iotdb-core · fixed in 1.3.0
- CVE-2023-46749Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Maven · org.apache.shiro:shiro-core · fixed in 1.13.0, 2.0.0-alpha4
- CVE-2023-50290Apache Solr: Host environment variables are published via the Metrics APIMaven · org.apache.solr:solr-core · fixed in 9.3.0
- CVE-2024-22492A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbiMaven · com.jfinal:jfinal
- CVE-2024-22493A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbiMaven · com.jfinal:jfinal
- CVE-2023-6149Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security Maven · com.qualys.plugins:qualys-was · fixed in 2.0.12
- CVE-2023-6148Possible XSS vulnerability in Jenkins Plugin for Qualys Policy ComplianceMaven · com.qualys.plugins:qualys-pc · fixed in 1.0.6
- CVE-2023-6147Possible XXE vulnerability in Jenkins Plugin for Qualys Policy ComplianceMaven · com.qualys.plugins:qualys-pc · fixed in 1.0.6
- CVE-2024-21648XWiki has no right protection on rollback actionMaven · org.xwiki.platform:xwiki-platform, org.xwiki.platform:xwiki-platform-oldcore · fixed in 15.5.3, 15.8-rc-1, 14.10.17
- CVE-2024-21651XWiki Denial of Service attack through attachmentsMaven · org.xwiki.platform:xwiki-platform-distribution-war · fixed in 14.10.18, 15.5.3, 15.8-rc-1
- CVE-2024-21650XWiki Remote Code Execution vulnerability via user registrationMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 14.10.17, 15.5.3, 15.8-rc-1