Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-6911Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can beMaven · org.wso2.carbon.registry:carbon-registry · fixed in 4.7.37
- CVE-2023-6886xnx3 wangmarket Role Management Page code injectionMaven · com.xnx3.wangmarket:wangmarket
- CVE-2023-50723XWiki Platform remote code execution/programming rights with configuration section from any user accountMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 14.10.15, 15.5.2, 15.7-rc-1
- CVE-2023-50722XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClassMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 14.10.15, 15.5.2, 15.7-rc-1
- CVE-2023-50721XWiki Platform RCE from account through SearchAdminMaven · org.xwiki.platform:xwiki-platform-search-ui · fixed in 14.10.15, 15.5.2, 15.7-rc-1
- CVE-2023-50719XWiki Platform Solr search discloses password hashes of all usersMaven · org.xwiki.platform:xwiki-platform-search-solr-api · fixed in 14.10.15, 15.5.2, 15.7-rc-1
- CVE-2023-50720XWiki Platform Solr search discloses email addresses of usersMaven · org.xwiki.platform:xwiki-platform-search-solr-api · fixed in 14.10.15, 15.5.2, 15.7-rc-1
- CVE-2023-30867Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerabilityMaven · org.apache.streampark:streampark · fixed in 2.1.2
- CVE-2023-49898Apache StreamPark (incubating): Authenticated system users could trigger remote command executionMaven · org.apache.streampark:streampark · fixed in 2.1.2
- CVE-2023-6837Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationMaven · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework, org.wso2.identity.apps:authentication-portal · fixed in 5.20.254, 1.6.179.1
- CVE-2023-6836Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely usMaven · org.wso2.am:wso2am, org.wso2.carbon.analytics-common:org.wso2.carbon.event.input.adapter.core +4 · fixed in 4.0.0-beta, 5.2.23, 4.7.24 and more
- CVE-2023-6835Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating couldMaven · org.wso2.carbon.apimgt:forum
- CVE-2023-46279Apache Dubbo: Bypass deny serialize list check in Apache DubboMaven · org.apache.dubbo:dubbo · fixed in 3.1.6
- CVE-2023-29234Bypass serialize checks in Apache DubboMaven · org.apache.dubbo:dubbo · fixed in 3.1.11, 3.2.5
- CVE-2023-6134Keycloak: reflected xss via wildcard in oidc redirect_uriMaven · org.keycloak:keycloak-services · fixed in 23.0.3
- CVE-2023-6563Keycloak: offline session token dosMaven · org.keycloak:keycloak-model-jpa · fixed in 21.0.0
- CVE-2023-46750Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.Maven · org.apache.shiro:shiro-web · fixed in 1.13.0, 2.0.0-alpha-4
- CVE-2023-50100JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.Maven · com.jfinal:jfinal
- CVE-2023-50101JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.Maven · com.jfinal:jfinal
- CVE-2023-50102JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).Maven · com.jfinal:jfinal
- CVE-2023-50137JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.Maven · com.jfinal:jfinal
- CVE-2023-50779Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to aMaven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50778A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an atMaven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50777Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, incMaven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50776Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins Maven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50775A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.Maven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2023-50774A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary filesMaven · org.jenkins-ci.plugins:htmlresource
- CVE-2023-50773Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the poteMaven · com.zintow:dingding-json-pusher
- CVE-2023-50772Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller whereMaven · com.zintow:dingding-json-pusher
- CVE-2023-50771Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing Maven · org.jenkins-ci.plugins:oic-auth · fixed in 3.0