Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-41938A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules.Maven · org.jenkins-ci.plugins:ivy
- CVE-2023-41937Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, includingMaven · io.jenkins.plugins:bitbucket-push-and-pull-request · fixed in 2.8.4
- CVE-2023-41936Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected tokMaven · org.jenkins-ci.plugins:google-login · fixed in 1.8
- CVE-2023-41935Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when chMaven · org.jenkins-ci.plugins:azure-ad · fixed in 397.v907382dd9b, 378.vd6e2874a
- CVE-2023-41934Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of Maven · org.jenkins-ci.plugins:pipeline-maven · fixed in 1331.v003efa_fd6e81
- CVE-2023-41933Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 1229.v3039470161a_d
- CVE-2023-41932Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpointMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 1229.v3039470161a_d
- CVE-2023-41931Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from histoMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 1229.v3039470161a_d
- CVE-2023-41930Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a histoMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 1229.v3039470161a_d
- CVE-2023-40743Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceMaven · axis:axis, org.apache.axis:axis
- CVE-2023-41046Velocity execution without script rights in Xwiki platformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.10, 15.4-rc-1
- CVE-2023-39685An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.Maven · org.hjson:hjson · fixed in 3.0.1
- CVE-2023-40771SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of thMaven · io.dataease:dataease-plugin-common
- CVE-2023-41045Insecure source port usage for DNS queries in GraylogMaven · org.graylog2:graylog2-server · fixed in 5.1.3, 5.0.9
- CVE-2023-41044Partial path traversal vulnerability in Support Bundle feature of GraylogMaven · org.graylog2:graylog2-server · fixed in 5.1.3
- CVE-2023-41034DDFFileParser in eclipse leshan is vulnerable to XXE AttacksMaven · org.eclipse.leshan:leshan-core · fixed in 1.5.0, 2.0.0-M13
- CVE-2023-41041User session is still usable after logout in graylog2-server Maven · org.graylog2:graylog2-server · fixed in 5.0.9, 5.1.3
- CVE-2023-40787In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL Maven · org.springblade:blade-core-tool
- CVE-2023-40826An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zipplugMaven · org.pf4j:pf4j
- CVE-2023-40827An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluMaven · org.pf4j:pf4j
- CVE-2023-40828An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIMaven · org.pf4j:pf4j
- CVE-2023-41080Apache Tomcat: Open redirect with FORM authenticationMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 8.5.93, 9.0.80, 10.1.13 and more
- CVE-2023-24620An issue was discovered in Esoteric YamlBeans through 1.15.Maven · com.esotericsoftware.yamlbeans:yamlbeans
- CVE-2023-24621An issue was discovered in Esoteric YamlBeans through 1.15.Maven · com.esotericsoftware.yamlbeans:yamlbeans
- CVE-2023-34040Java Deserialization vulnerability in Spring-Kafka When Improperly ConfiguredMaven · org.springframework.kafka:spring-kafka · fixed in 2.9.11, 3.0.10
- CVE-2023-40573XWiki Platform's Groovy jobs check the wrong author, allowing remote code executionMaven · com.xpn.xwiki.platform.plugins:xwiki-plugin-scheduler, org.xwiki.platform:xwiki-platform-scheduler-api · fixed in 14.10.9, 15.4-rc-1
- CVE-2023-40572XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create actionMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.9, 15.4-rc-1
- CVE-2023-40177XWiki Platform privilege escalation (PR) from account through AWM content fieldsMaven · org.xwiki.platform:xwiki-platform-appwithinminutes-ui · fixed in 14.10.5
- CVE-2023-40176SXSS in the user profile via the timezone displayerMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.10.5
- CVE-2022-44729Apache XML Graphics Batik: Information disclosure vulnerabilityMaven · org.apache.xmlgraphics:batik-bridge, org.apache.xmlgraphics:batik-svgrasterizer +1 · fixed in 1.17