Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-44981Apache ZooKeeper: Authorization bypass in SASL Quorum Peer AuthenticationMaven · org.apache.zookeeper:zookeeper · fixed in 3.7.2, 3.8.3, 3.9.1
- CVE-2023-45648Apache Tomcat: Trailer header parsing too lenientMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.0-M12, 10.1.14, 9.0.81 and more
- CVE-2023-42795Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +2 · fixed in 10.1.14, 9.0.81, 8.5.94 and more
- CVE-2023-42794Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsMaven · org.apache.tomcat:tomcat-coyote · fixed in 9.0.81, 8.5.94
- CVE-2023-36566Microsoft Common Data Model SDK Denial of Service VulnerabilityMaven · com.microsoft.commondatamodel:objectmodel · fixed in 1.7.4
- CVE-2023-36478HTTP/2 HPACK integer overflow and buffer allocationMaven · org.eclipse.jetty.http2:http2-hpack, org.eclipse.jetty.http3:http3-qpack · fixed in 10.0.16, 11.0.16, 9.4.53
- CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, asMaven · com.typesafe.akka:akka-http-core, com.typesafe.akka:akka-http-core_2.11 +8 · fixed in 10.5.3, 11.0.0-M12, 10.1.14 and more
- CVE-2023-43643mXSS in AntiSamyMaven · org.owasp.antisamy:antisamy · fixed in 1.7.4
- CVE-2023-36820micronaut security has invalid IdTokenClaimsValidator logic on audMaven · io.micronaut.security:micronaut-security-oauth2 · fixed in 3.11.1, 3.10.2, 3.9.6 and more
- CVE-2023-25822ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elementsMaven · com.epam.reportportal:service-api · fixed in 5.10.0
- CVE-2023-45303ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supMaven · org.thingsboard:thingsboard · fixed in 3.5
- CVE-2023-42809Redisson unsafe deserialization vulnerabilityMaven · org.redisson:redisson · fixed in 3.22.0
- CVE-2023-2422Keycloak: oauth client impersonationMaven · org.keycloak:keycloak-services · fixed in 21.1.2
- CVE-2023-1584Quarkus-oidc: id and access tokens leak via the authorization code flowMaven · io.quarkus:quarkus-oidc · fixed in 2.13.0.Final, 3.1.0.Final
- CVE-2023-39410Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDKMaven · org.apache.avro:avro · fixed in 1.11.3
- CVE-2023-3223Undertow: outofmemoryerror due to @multipartconfig handlingMaven · io.undertow:undertow-parent · fixed in 2.2.24.Final
- CVE-2022-4245Codehaus-plexus: xml external entity (xxe) injectionMaven · org.codehaus.plexus:plexus-utils · fixed in 3.0.24
- CVE-2022-4244Codehaus-plexus: directory traversalMaven · org.codehaus.plexus:plexus-utils · fixed in 3.0.24
- CVE-2022-4137Keycloak: reflected xss attackMaven · org.keycloak:keycloak-parent · fixed in 20.0.5
- CVE-2023-43642Missing upper bound check on chunk length in snappy-java Maven · org.xerial.snappy:snappy-java · fixed in 1.1.10.4
- CVE-2023-40989SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted requesMaven · org.jeecgframework.boot:jeecg-boot-common · fixed in 3.6.0
- CVE-2023-43498In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.414.2, 2.424
- CVE-2023-43502A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete FailMaven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 2.4.2
- CVE-2023-43501A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to conneMaven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 2.4.2
- CVE-2023-43500A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to Maven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 2.4.2
- CVE-2023-43499Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site Maven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 2.4.2
- CVE-2023-43497In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in thMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.414.2, 2.424
- CVE-2023-43496Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions fMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.414.2, 2.424
- CVE-2023-43495Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNotMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.414.2, 2.424
- CVE-2023-43494Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., pMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.414.2, 2.424