Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-50772Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller whereMaven · com.zintow:dingding-json-pusher
- CVE-2023-50771Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing Maven · org.jenkins-ci.plugins:oic-auth · fixed in 3.0
- CVE-2023-50770Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a Maven · org.jenkins-ci.plugins:oic-auth · fixed in 4.229.vf736b
- CVE-2023-50769Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to Maven · org.sonatype.nexus.ci:nexus-jenkins-plugin · fixed in 3.18.1-01
- CVE-2023-50768A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an aMaven · org.sonatype.nexus.ci:nexus-jenkins-plugin · fixed in 3.18.1-01
- CVE-2023-50767Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTMaven · org.sonatype.nexus.ci:nexus-jenkins-plugin · fixed in 3.18.1-01
- CVE-2023-50766A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP reMaven · org.sonatype.nexus.ci:nexus-jenkins-plugin · fixed in 3.18.1-01
- CVE-2023-50765A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read Maven · org.jenkins-ci.plugins:scriptler
- CVE-2023-50764Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackerMaven · org.jenkins-ci.plugins:scriptler
- CVE-2023-6379Cross-site Scripting in Alkacon Software OpenCmsMaven · org.opencms:opencms-core · fixed in 16.0.0
- CVE-2023-47320Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control.Maven · org.silverpeas.core:silverpeas-core-war, org.silverpeas.core:silverpeas-core-web · fixed in 6.3.2
- CVE-2023-47321Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portletMaven · org.silverpeas.core:silverpeas-core-web · fixed in 6.3.2
- CVE-2023-47322The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation.Maven · org.silverpeas.core:silverpeas-core-web · fixed in 6.3.2
- CVE-2023-47323The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter.Maven · org.silverpeas.core:silverpeas-core-api, org.silverpeas.core:silverpeas-core-web · fixed in 6.3.2
- CVE-2023-47324Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature.Maven · org.silverpeas.core:silverpeas-core-api, org.silverpeas.core:silverpeas-core-configuration +2 · fixed in 6.3.2
- CVE-2023-47325Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control.Maven · org.silverpeas.core:silverpeas-core-web · fixed in 6.3.2
- CVE-2023-47326Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.Maven · org.silverpeas.core:silverpeas-core · fixed in 6.3.2
- CVE-2023-47327The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators.Maven · org.silverpeas.core:silverpeas-core-web · fixed in 6.3.2
- CVE-2023-50424Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)Maven · com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security:java-security +1 · fixed in 2.17.0, 3.3.0
- CVE-2023-50422Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)Maven · com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security:java-security +1 · fixed in 2.17.0, 3.3.0
- CVE-2018-16153An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6.Maven · org.opencastproject:opencast-common · fixed in 10.6
- CVE-2023-26920fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.Maven · org.apache.druid:druid-core · fixed in 0.21.0
- CVE-2023-28465The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to cerMaven · ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.core +4 · fixed in 5.6.106
- CVE-2023-50449JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.Maven · com.jfinal:jfinal
- CVE-2023-6394Quarkus: graphql operations over websockets bypassMaven · io.quarkus:quarkus-smallrye-graphql-client · fixed in 3.5.3, 2.13.9.Final
- CVE-2023-49485JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.Maven · com.jfinal:jfinal
- CVE-2023-49486JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.Maven · com.jfinal:jfinal
- CVE-2023-49487JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.Maven · com.jfinal:jfinal
- CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerabilityMaven · org.apache.struts:struts2-core · fixed in 2.5.33, 6.3.0.2
- CVE-2023-6393Quarkus: potential invalid reuse of context when @cacheresult on a uni is usedMaven · io.quarkus:quarkus-cache · fixed in 3.5.2, 3.2.9.Final