Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-40311Stored XSS in multiple JSP files in opennms/opennmsMaven · org.opennms:opennms-webapp · fixed in 32.0.2
- CVE-2023-0872ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/usersMaven · org.opennms:opennms-webapp-rest · fixed in 32.0.2
- CVE-2023-0871An XML External Entity injection vulnerabilityMaven · org.opennms.core:org.opennms.core.xml · fixed in 32.0.2
- CVE-2020-24922Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execuMaven · com.xuxueli:xxl-job
- CVE-2023-3894DOS in jackson-dataformats-textMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-toml · fixed in 2.15.0
- CVE-2023-0264A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests.Maven · org.keycloak:keycloak-services · fixed in 21.0.1
- CVE-2023-36480Aerospike Java Client vulnerable to unsafe deserialization of server responsesMaven · com.aerospike:aerospike-client · fixed in 6.2.0, 5.2.0, 4.5.0
- CVE-2022-41401OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, poMaven · org.openrefine:main · fixed in 3.6.0
- CVE-2023-4136Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter EngineMaven · org.craftercms:crafter-engine · fixed in 4.0.3, 3.1.28
- CVE-2023-3426The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permissiMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.organizations.item.selector.web · fixed in 4.0.14
- CVE-2023-36542Apache NiFi: Potential Code Injection with Properties Referencing Remote ResourcesMaven · org.apache.nifi:nifi-cdc-mysql-bundle, org.apache.nifi:nifi-dbcp-service +6 · fixed in 1.23.0
- CVE-2023-3990Mingsoft MCMS HTTP POST Request search.do cross site scriptingMaven · net.mingsoft:ms-mcms · fixed in 5.3.2
- CVE-2023-37754PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.Maven · tech.powerjob:powerjob-common
- CVE-2023-38992jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.Maven · org.jeecgframework.boot:jeecg-boot-common · fixed in 3.5.3
- CVE-2023-39010BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load.Maven · org.boofcv:boofcv-core · fixed in 0.43.1
- CVE-2023-39013Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.initMaven · no.priv.garshol.duke:duke
- CVE-2023-39015webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloaMaven · us.codecraft:webmagic-core
- CVE-2023-39020stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedMaven · edu.stanford.nlp:stanford-parser · fixed in 4.5.5
- CVE-2023-39021wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.SetMaven · com.wix:wix-embedded-mysql
- CVE-2023-39022oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateMaven · opensymphony:oscore
- CVE-2023-38509XWiki Platform's obfuscated email addresses should not be sortedMaven · org.xwiki.platform:xwiki-platform-livetable-ui · fixed in 14.10.9, 15.3-rc-1
- CVE-2023-3442Missing Authorization in Jenkins plug-in for ServiceNow DevOpsMaven · io.jenkins.plugins:servicenow-devops · fixed in 1.38.1
- CVE-2023-3414Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOpsMaven · io.jenkins.plugins:servicenow-devops · fixed in 1.38.1
- CVE-2023-39156A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created BaMaven · org.jenkins-ci.plugins:bazaar
- CVE-2023-39155Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe Maven · org.jenkins-ci.plugins:chef-identity
- CVE-2023-39154Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/ConfigurMaven · com.qualys.plugins:qualys-was · fixed in 2.0.11
- CVE-2023-39153A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick usersMaven · org.jenkins-ci.plugins:gitlab-oauth · fixed in 1.18
- CVE-2023-39152Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asMaven · org.jenkins-ci.plugins:gradle · fixed in 2.8.1
- CVE-2023-39151Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.414.1, 2.401.3, 2.416
- CVE-2023-38647Apache Helix: Deserialization vulnerability in Helix workflow and RESTMaven · org.apache.helix:helix-core, org.apache.helix:helix-rest · fixed in 1.3.0