cve.nowby Sazabi

Packages

Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.

CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alMaven · com.pubnub:pubnub, com.pubnub:pubnub-kotlin · fixed in 7.7.0Medium · 5.9Fix availableDec 6, 2023
CVE-2023-46674Elasticsearch-hadoop Unsafe DeserializationMaven · org.elasticsearch:elasticsearch-hadoop · fixed in 7.17.11, 8.9.0Medium · 6.0Fix availableDec 5, 2023
CVE-2023-41835Apache Struts: excessive disk usageMaven · org.apache.struts:struts2-core · fixed in 6.3.0.1, 6.1.2.2, 2.5.32High · 7.5Fix availableDec 5, 2023
CVE-2023-49372JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49373JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49374JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49375JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49376JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49377JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49378JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49379JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49380JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49381JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49382JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49383JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49395JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49396JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49397JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49398JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49446JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49447JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49448JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.Maven · com.jfinal:jfinalUnratedNo patch listed yetDec 5, 2023
CVE-2023-49280Data leak of password hash through xwiki change requestMaven · org.xwiki.contrib.changerequest:application-changerequest-default · fixed in 1.10High · 7.7Fix availableDec 4, 2023
CVE-2023-6481Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fixMaven · ch.qos.logback:logback-core · fixed in 1.4.14, 1.3.14, 1.2.13High · 7.1Fix availableDec 4, 2023
CVE-2023-49093HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTLMaven · org.htmlunit:htmlunit · fixed in 3.9.0Critical · 9.8Fix availableDec 4, 2023
CVE-2023-48910Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download.Maven · io.github.microcks:microcks · fixed in 1.17.1Critical · 9.8Fix availableDec 4, 2023
CVE-2023-48967Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.Maven · org.noear:solonUnratedNo patch listed yetDec 4, 2023
CVE-2023-48887A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.Maven · org.jupiter-rpc:jupiter-rpcUnratedNo patch listed yetDec 1, 2023
CVE-2023-49371RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.Maven · com.ruoyi:ruoyiUnratedNo patch listed yetDec 1, 2023
CVE-2023-49735Apache Tiles: Unvalidated input may lead to path traversal and XXEMaven · org.apache.struts:struts-tiles, org.apache.tiles:tiles-core +1LowNo patch listed yetNov 30, 2023