Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-49733Apache Cocoon's StreamGenerator is vulnerable to XXE injectionMaven · org.apache.cocoon:cocoon · fixed in 2.3.0
- CVE-2023-49620Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized forMaven · org.apache.dolphinscheduler:dolphinscheduler-api, org.apache.dolphinscheduler:dolphinscheduler-common +2 · fixed in 3.1.0
- CVE-2022-45135Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorActionMaven · org.apache.cocoon:cocoon · fixed in 2.3.0
- CVE-2023-49674A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission Maven · io.jenkins.plugins:neuvector-vulnerability-scanner · fixed in 2.2
- CVE-2023-49673A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to conMaven · io.jenkins.plugins:neuvector-vulnerability-scanner · fixed in 2.2
- CVE-2023-49656Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:matlab · fixed in 2.11.1
- CVE-2023-49655A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML Maven · org.jenkins-ci.plugins:matlab · fixed in 2.11.1
- CVE-2023-49654Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins conMaven · org.jenkins-ci.plugins:matlab · fixed in 2.11.1
- CVE-2023-49653Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure perMaven · org.jenkins-ci.plugins:jira · fixed in 3.12
- CVE-2023-49652Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/ConfMaven · org.jenkins-ci.plugins:google-compute-engine · fixed in 4.3.17.1, 4.551.v5a
- CVE-2023-6378Logback "receiver" DOS vulnerability Maven · ch.qos.logback:logback-classic, ch.qos.logback:logback-core · fixed in 1.3.12, 1.4.12, 1.2.13
- CVE-2023-46589Apache Tomcat: HTTP request smuggling via malformed trailer headersMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina +1 · fixed in 11.0.0-M11, 10.1.16, 9.0.83 and more
- CVE-2022-41678Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCEMaven · org.apache.activemq:apache-activemq · fixed in 5.16.6, 5.17.4
- CVE-2023-34055Spring Boot server Web Observations DoS VulnerabilityMaven · org.springframework.boot:spring-boot-actuator · fixed in 2.7.18, 3.0.13, 3.1.6
- CVE-2023-34054Reactor Netty HTTP Server Metrics DoS VulnerabilityMaven · io.projectreactor.netty:reactor-netty-core · fixed in 1.1.13, 1.0.39
- CVE-2023-34053Spring Framework server Web Observations DoS VulnerabilityMaven · org.springframework:spring-webmvc · fixed in 6.0.14
- CVE-2023-48848An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a craftMaven · com.bstek.ureport:ureport2-core
- CVE-2023-49145Apache NiFi: Improper Neutralization of Input in Advanced User Interface for JoltMaven · org.apache.nifi:nifi-jolt-transform-json-ui · fixed in 1.24.0
- CVE-2023-49068Apache DolphinScheduler: Information Leakage VulnerabilityMaven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 3.2.1
- CVE-2023-48796Apache dolphinscheduler sensitive information disclosureMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.0.2
- CVE-2023-43123Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary filesMaven · org.apache.storm:storm-core · fixed in 2.6.0
- CVE-2023-33202Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMPMaven · org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcprov-ext-jdk15on +7 · fixed in 1.73
- CVE-2023-46673It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when Maven · org.elasticsearch:elasticsearch · fixed in 7.17.14, 8.10.3
- CVE-2021-37942APM Java Agent Local Privilege EscalationMaven · co.elastic.apm:apm-agent-parent, co.elastic.apm:elastic-apm-agent · fixed in 1.27.1
- CVE-2023-47467Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file dirMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-48293XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queriesMaven · org.xwiki.contrib:xwiki-application-admintools · fixed in 4.5.1
- CVE-2023-48292XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacksMaven · org.xwiki.contrib:xwiki-application-admintools · fixed in 4.5.1
- CVE-2023-48241XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest serviceMaven · org.xwiki.platform:xwiki-platform-search-solr-query · fixed in 14.10.15, 15.5.1
- CVE-2023-48240XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgeryMaven · org.xwiki.platform:xwiki-platform-diff-xml · fixed in 14.10.15, 15.5.1, 15.6
- CVE-2022-46337Apache Derby: LDAP injection vulnerability in authenticatorMaven · org.apache.derby:derby · fixed in 10.14.2.1, 10.16.1.2, 10.15.2.1