Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-43795WPS Server Side Request Forgery in GeoServerMaven · org.geoserver.extension:gs-wps-core · fixed in 2.22.5, 2.23.2
- CVE-2023-41339Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServerMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-wms · fixed in 2.22.5, 2.23.2
- CVE-2023-31580light-oauth2 before version 2.1.27 obtains the public key without any verification.Maven · com.networknt:light-oauth2 · fixed in 2.1.27
- CVE-2023-31581Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.Maven · com.usthe.sureness:sureness-core · fixed in 1.0.8
- CVE-2023-31582jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.Maven · org.bitbucket.b_c:jose4j · fixed in 0.9.3
- CVE-2023-46122Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbtMaven · org.scala-sbt:io_2.12, org.scala-sbt:io_2.13 +2 · fixed in 1.9.7
- CVE-2023-44483Apache Santuario: Private Key disclosure in debug-log outputMaven · org.apache.santuario:xmlsec · fixed in 2.3.4, 2.2.6, 3.0.3
- CVE-2023-46227Apache inlong has an Arbitrary File Read VulnerabilityMaven · org.apache.inlong:manager-common, org.apache.inlong:manager-pojo · fixed in 1.9.0
- CVE-2023-25753Server-Side Request Forgery in Apache ShenYuMaven · org.apache.shenyu:shenyu-admin, org.apache.shenyu:shenyu-common · fixed in 2.6.0
- CVE-2023-45277Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2).Maven · org.yamcs:yamcs · fixed in 5.8.7
- CVE-2023-45278Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafMaven · org.yamcs:yamcs · fixed in 5.8.7
- CVE-2023-45279Yamcs 5.8.6 allows XSS (issue 1 of 2).Maven · org.yamcs:yamcs · fixed in 5.8.7
- CVE-2023-45280Yamcs 5.8.6 allows XSS (issue 2 of 2).Maven · org.yamcs:yamcs · fixed in 5.8.7
- CVE-2023-45146Remote code execution in XXL-RPCMaven · com.xuxueli:xxl-rpc-core
- CVE-2023-22102Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).Maven · com.mysql:mysql-connector-j, mysql:mysql-connector-java · fixed in 8.2.0
- CVE-2023-42627Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP Maven · com.liferay.commerce:com.liferay.commerce.address.content.web, com.liferay.portal:release.dxp.bom · fixed in 4.0.35
- CVE-2023-42628Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.wiki.web · fixed in 7.3.10.u34, 7.4.13.u88, 7.0.95
- CVE-2023-44311Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class iMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.oauth2.provider.rest · fixed in 7.4.13.u90, 4.0.51
- CVE-2023-44310Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 throMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.layout.impl · fixed in 7.4.13.u79, 6.0.102
- CVE-2023-44309Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.fragment.entry.processor.impl · fixed in 7.4.13.u54, 3.0.25
- CVE-2023-42629Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 Maven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.asset.categories.admin.web · fixed in 7.4.13.u88, 5.0.87
- CVE-2023-42497Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and LiferaMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.translation.web · fixed in 7.4.13.u86, 2.0.86
- CVE-2023-45807OpenSearch Issue with tenant read-only permissionsMaven · org.opensearch.plugin:opensearch-security · fixed in 2.11.0.0, 1.3.14.0
- CVE-2023-45144Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki AppMaven · com.xwiki.identity-oauth:identity-oauth-ui · fixed in 1.6
- CVE-2023-45669Improper signature counter value handling in webauthn4j-spring-security Maven · com.webauthn4j:webauthn4j-spring-security-core · fixed in 0.9.1.RELEASE
- CVE-2023-43666Apache InLong: General user Unauthorized access User ManagementMaven · org.apache.inlong:inlong · fixed in 1.9.0
- CVE-2023-43667Apache InLong: Log Injection in Global functionsMaven · org.apache.inlong:inlong · fixed in 1.8.0
- CVE-2023-43668Apache InLong: Jdbc Connection Security Bypass in InLongMaven · org.apache.inlong:manager-pojo · fixed in 1.9.0
- CVE-2023-45138Change Request Application vulnerable to XSS and remote code execution through change request titleMaven · org.xwiki.contrib.changerequest:application-changerequest-ui · fixed in 1.9.2
- CVE-2023-5072DoS Vulnerability in JSON-JavaMaven · org.json:json · fixed in 20231013