Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-31579Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token.Maven · top.tangyh.basic:lamp-core, top.tangyh.basic:lamp-util · fixed in 3.8.1
- CVE-2023-46502An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocuMaven · org.opencrx:opencrx-client · fixed in 5.3.0
- CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackMaven · org.apache.activemq:activemq-client, org.apache.activemq:activemq-openwire-legacy · fixed in 5.15.16, 5.16.7, 5.17.6 and more
- CVE-2023-31417Elasticsearch Insertion of sensitive information in audit logsMaven · org.elasticsearch:elasticsearch · fixed in 7.17.13, 8.9.2
- CVE-2023-31418Elasticsearch uncontrolled resource consumptionMaven · org.elasticsearch:elasticsearch · fixed in 7.17.13, 8.9.0
- CVE-2023-31419Elasticsearch StackOverflow vulnerabilityMaven · org.elasticsearch:elasticsearch · fixed in 7.17.13, 8.9.1
- CVE-2023-45137XWiki Platform XSS with edit right in the create document form for existing pagesMaven · org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-web-templates · fixed in 13.4-rc-1, 14.10.12, 15.5-rc-1
- CVE-2023-45136XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabledMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.10.12, 15.5-rc-1
- CVE-2023-45135XWiki users can be tricked to execute scripts as the create page action doesn't display the page's titleMaven · org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.10.12, 15.5-rc-1
- CVE-2023-45134XWiki Platform XSS vulnerability from account in the create page form via template providerMaven · org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-web-templates +1 · fixed in 13.4-rc-1, 14.10.12, 15.5-rc-1 and more
- CVE-2023-37913org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converterMaven · org.xwiki.platform:xwiki-platform-office-importer · fixed in 14.10.8, 15.3-rc-1
- CVE-2023-37912XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macroMaven · org.xwiki.platform:xwiki-core-rendering-macro-footnotes, org.xwiki.rendering:xwiki-rendering-macro-footnotes · fixed in 14.10.6, 15.1-rc-1
- CVE-2023-37911org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documentsMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.8, 15.3-rc-1
- CVE-2023-37910org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment MoveMaven · org.xwiki.platform:xwiki-platform-attachment-api · fixed in 14.4.8, 14.10.4
- CVE-2023-37909Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheetMaven · org.xwiki.platform:xwiki-platform-menu, org.xwiki.platform:xwiki-platform-menu-ui · fixed in 14.10.8, 15.3-rc-1
- CVE-2023-37908org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityMaven · org.xwiki.rendering:xwiki-rendering-xml · fixed in 14.10.4
- CVE-2023-46660Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook tMaven · org.jenkins-ci.plugins:zanata
- CVE-2023-46659Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripMaven · org.jenkins-ci.plugins:trac
- CVE-2023-46658Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided andMaven · io.jenkins.plugins:teams-webhook-trigger
- CVE-2023-46657Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook Maven · org.jenkins-ci.plugins:gogs-webhook
- CVE-2023-46656Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the proMaven · igalg.jenkins.plugins:multibranch-scan-webhook-trigger
- CVE-2023-46655Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publishMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.33
- CVE-2023-46654Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup procMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.33
- CVE-2023-46653Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting iMaven · org.jenkins-ci.plugins:lambdatest-automation · fixed in 1.21.0
- CVE-2023-46652A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumeMaven · org.jenkins-ci.plugins:lambdatest-automation · fixed in 1.20.10
- CVE-2023-46651Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/ConfiguMaven · io.jenkins.plugins:warnings-ng · fixed in 10.5.1, 10.4.1
- CVE-2023-46650Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a storeMaven · com.coravy.hudson.plugins.github:github · fixed in 1.37.3.1
- CVE-2023-43961An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authMaven · cn.dev33:sa-token-core · fixed in 1.36.0
- CVE-2023-44794An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.Maven · cn.dev33:sa-token-core · fixed in 1.37.0
- CVE-2023-46120RabbitMQ Java client's lack of message size limitation leads to remote DoS attackMaven · com.rabbitmq:amqp-client · fixed in 5.18.0