Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-3916Keycloak: session takeover with oidc offline refreshtokensMaven · org.keycloak:keycloak-parent · fixed in 20.0.2
- CVE-2022-1438Keycloak: xss on impersonation under specific circumstancesMaven · org.keycloak:keycloak-services
- CVE-2023-4853Quarkus: http security policy bypassMaven · io.quarkus:quarkus-csrf-reactive, io.quarkus:quarkus-keycloak-authorization +2 · fixed in 2.16.11.Final, 3.2.6.Final, 3.3.3
- CVE-2023-34047Exposure of data and identity to wrong session in Spring for GraphQLMaven · org.springframework.graphql:spring-graphql · fixed in 1.1.6, 1.2.3
- CVE-2023-41900Jetty's OpenId Revoked authentication allows one requestMaven · org.eclipse.jetty:jetty-openid · fixed in 9.4.52.v20230823, 10.0.16, 11.0.16
- CVE-2023-41887Remote Code exec in project import with mysql jdbc url attackMaven · org.openrefine:database · fixed in 3.7.5
- CVE-2023-41886OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attackMaven · org.openrefine:database · fixed in 3.7.5
- CVE-2023-40167Jetty accepts "+" prefixed value in Content-LengthMaven · org.eclipse.jetty:jetty-http · fixed in 9.4.52, 10.0.16, 11.0.16 and more
- CVE-2023-36479Jetty vulnerable to errant command quoting in CGI ServletMaven · org.eclipse.jetty.ee10:jetty-ee10-servlets, org.eclipse.jetty.ee8:jetty-ee8-servlets +2 · fixed in 12.0.0-beta2, 9.4.52, 10.0.16 and more
- CVE-2023-1108Undertow: infinite loop in sslconduit during closeMaven · io.undertow:undertow-core · fixed in 2.3.5.Final, 2.2.24.Final
- CVE-2023-42503Apache Commons Compress: Denial of service via CPU consumption for malformed TAR fileMaven · org.apache.commons:commons-compress · fixed in 1.24.0
- CVE-2023-4918Plaintext storage of user passwordMaven · org.keycloak:keycloak-core · fixed in 22.0.3
- CVE-2023-4759Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file writeMaven · org.eclipse.jgit:org.eclipse.jgit · fixed in 6.6.1.202309021850-r, 5.13.3.202401111512-r
- CVE-2022-1415Drools: unsafe data deserialization in streamutilsMaven · org.drools:drools-core · fixed in 7.69.0.Final
- CVE-2023-41578Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-42268Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-42276hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.Maven · cn.hutool:hutool-core, cn.hutool:hutool-json
- CVE-2023-42277hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.Maven · cn.hutool:hutool-core, cn.hutool:hutool-json
- CVE-2023-42278hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().Maven · cn.hutool:hutool-core, cn.hutool:hutool-json · fixed in 5.8.22
- CVE-2023-41327Controlled SSRF through URL in the WireMockMaven · org.wiremock:wiremock-webhooks-extension · fixed in 3.0.3, 2.35.1
- CVE-2023-41329Domain restrictions bypass via DNS Rebinding in WireMock and WireMock StudioMaven · com.github.tomakehurst:wiremock-jre8, com.github.tomakehurst:wiremock-jre8-standalone +2 · fixed in 2.35.1, 3.0.3
- CVE-2023-41947A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to FrugMaven · io.jenkins.plugins:frugal-testing
- CVE-2023-41946A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal TesMaven · io.jenkins.plugins:frugal-testing
- CVE-2023-41945Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permiMaven · org.jenkins-ci.plugins:assembla-auth
- CVE-2023-41944Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41943Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with OvMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41942A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the Maven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41941A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41940Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitMaven · org.tap4j:tap
- CVE-2023-41939Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users fMaven · org.jenkins-ci.plugins:ssh2easy · fixed in 1.6