Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-51441Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP APIMaven · axis:axis, org.apache.axis:axis
- CVE-2024-21634Ion Java StackOverflow vulnerabilityMaven · com.amazon.ion:ion-java, software.amazon.ion:ion-java · fixed in 1.10.5
- CVE-2023-51784Apache InLong: Remote Code Execution vulnerability in Apache InLong ManagerMaven · org.apache.inlong:manager-pojo · fixed in 1.10.0
- CVE-2023-51785Apache InLong: Arbitrary File Read Vulnerability in Apache InLong ManagerMaven · org.apache.inlong:manager-pojo · fixed in 1.10.0
- CVE-2023-49299Apache DolphinScheduler: Arbitrary js execute as root for authenticated usersMaven · org.apache.dolphinscheduler:dolphinscheduler-master · fixed in 3.1.9
- CVE-2023-41542SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information viaMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-41543SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the coMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-41544SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the Maven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-50578Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.Maven · net.mingsoft:ms-mcms
- CVE-2023-7148ShifuML shifu Java Expression Language DataPurifier.java code injectionMaven · ml.shifu:shifu
- CVE-2023-50571easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.Maven · org.jeasy:easy-rules-mvel
- CVE-2023-50572An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.Maven · org.jline:jline-parent · fixed in 3.25.0
- CVE-2023-51074json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.Maven · com.jayway.jsonpath:json-path · fixed in 2.9.0
- CVE-2023-51075hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function.Maven · cn.hutool:hutool-core · fixed in 5.8.24
- CVE-2023-51079A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups.Maven · org.mvel:mvel2
- CVE-2023-51080The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.Maven · cn.hutool:hutool-core · fixed in 5.8.25
- CVE-2023-51084hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.Maven · com.github:hyavijava
- CVE-2023-27150openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Maven · org.opencrx:opencrx-core
- CVE-2023-51775The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count)Maven · org.bitbucket.b_c:jose4j · fixed in 0.9.4
- CVE-2023-50730Grackle has StackOverflowError in GraphQL query processingMaven · edu.gemini:gsp-graphql-core_2.13, edu.gemini:gsp-graphql-core_3 +10 · fixed in 0.18.0
- CVE-2023-50732Velocity execution without script right through tree macroMaven · org.xwiki.platform:xwiki-platform-index-tree-macro · fixed in 14.10.7, 15.2-rc-1
- CVE-2023-51656Apache IoTDB: Unsafe deserialize map in Sync ToolMaven · org.apache.iotdb:iotdb-parent · fixed in 1.2.2
- CVE-2023-2585Keycloak: client access via device auth request spoofMaven · org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services · fixed in 21.1.2
- CVE-2023-46131Grails® data binding causes JVM crash and/or DoS Maven · org.grails:grails-databinding · fixed in 6.1.0, 5.3.4, 4.1.3 and more
- CVE-2023-37544Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoSMaven · org.apache.pulsar:pulsar-websocket · fixed in 2.10.5, 2.11.2, 3.0.1
- CVE-2023-6927Keycloak: open redirect via "form_post.jwt" jarm response modeMaven · org.keycloak:keycloak-core · fixed in 23.0.4
- CVE-2023-5384Infinispan: credentials returned from configuration as clear textMaven · org.infinispan:infinispan-cachestore-jdbc, org.infinispan:infinispan-cachestore-jdbc-common +6 · fixed in 15.0.0.Dev07, 14.0.25.Final
- CVE-2023-5236Infinispan: circular reference on marshalling leads to dosMaven · org.infinispan.protostream:protostream · fixed in 4.6.2.Final
- CVE-2023-3629Infinispan: non-admins should not be able to get cache config via rest apiMaven · org.infinispan:infinispan-server-rest · fixed in 15.0.0.Dev04, 14.0.18.Final
- CVE-2023-3628Infispan: rest bulk ops don't check permissionsMaven · org.infinispan:infinispan-server-rest · fixed in 15.0.0.Dev04, 14.0.18.Final