Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-38493Paths contain matrix variables bypass decoratorsMaven · com.linecorp.armeria:armeria · fixed in 1.24.3
- CVE-2023-37460Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiverMaven · org.codehaus.plexus:plexus-archiver · fixed in 4.8.0
- CVE-2023-38435Apache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole pluginMaven · org.apache.felix:org.apache.felix.healthcheck.webconsoleplugin · fixed in 2.1.0
- CVE-2023-37895Apache Jackrabbit RMI access can lead to RCEMaven · org.apache.jackrabbit:jackrabbit-standalone, org.apache.jackrabbit:jackrabbit-standalone-components +1 · fixed in 2.21.18, 2.20.11
- CVE-2023-35088Apache InLong: SQL injection in audit endpointMaven · org.apache.inlong:manager-service · fixed in 1.8.0
- CVE-2023-34434Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramMaven · org.apache.inlong:manager-pojo · fixed in 1.8.0
- CVE-2023-34189Apache InLong: General user can delete and update processMaven · org.apache.inlong:inlong-manager · fixed in 1.8.0
- CVE-2023-34478Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.Maven · org.apache.shiro:shiro-web · fixed in 1.12.0, 2.0.0-alpha-3
- CVE-2023-3815y_project RuoYi File Upload uploadFilesPath cross site scriptingMaven · com.ruoyi:ruoyi
- CVE-2023-37471User impersonation using SAMLv1.x SSO in Open Access Management Maven · org.openidentityplatform.openam:openam-federation-library · fixed in 14.7.3
- CVE-2023-37602An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary Maven · org.opencms:opencms-core
- CVE-2023-32263Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3Maven · org.jenkins-ci.plugins:dimensionsscm · fixed in 0.9.3.1
- CVE-2023-32262Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3Maven · org.jenkins-ci.plugins:dimensionsscm · fixed in 0.9.3.1
- CVE-2023-32261Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3Maven · org.jenkins-ci.plugins:dimensionsscm · fixed in 0.9.3.1
- CVE-2023-34034Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and SpMaven · org.springframework.security:spring-security-config · fixed in 5.6.12, 5.7.10, 5.8.5 and more
- CVE-2023-28754ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere AgentMaven · org.apache.shardingsphere:shardingsphere · fixed in 5.4.0
- CVE-2023-34035Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfigMaven · org.springframework.security:spring-security-config · fixed in 5.8.5, 6.0.5, 6.1.2
- CVE-2023-33265In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing auMaven · com.hazelcast:hazelcast, com.hazelcast:hazelcast-enterprise · fixed in 5.2.4, 5.1.7, 5.0.5
- CVE-2023-37476Zip slip in OpenRefineMaven · org.openrefine:main · fixed in 3.7.4
- CVE-2023-34036Forwarded header exploit with Spring HATEOAS on WebFluxMaven · org.springframework.hateoas:spring-hateoas · fixed in 1.5.5, 2.0.5, 2.1.1
- CVE-2023-26512Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted dataMaven · org.apache.eventmesh:eventmesh-connector-rabbitmq
- CVE-2023-37462Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiMaven · org.xwiki.platform:xwiki-platform-skin-ui · fixed in 14.4.8, 14.10.4
- CVE-2023-38286Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypasMaven · de.codecentric:spring-boot-admin-server · fixed in 3.1.2, 2.7.16
- CVE-2023-3635Okio GzipSource unhandled exception Denial of ServiceMaven · com.squareup.okio:okio, com.squareup.okio:okio-jvm · fixed in 3.4.0, 1.17.6
- CVE-2023-37965A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an Maven · org.jenkins-ci.plugins:elasticbox
- CVE-2023-37964A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attackMaven · org.jenkins-ci.plugins:elasticbox
- CVE-2023-37963A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect Maven · io.jenkins.plugins:benchmark-evaluator
- CVE-2023-37962A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an Maven · io.jenkins.plugins:benchmark-evaluator
- CVE-2023-37961A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into loggMaven · org.jenkins-ci.plugins:assembla-auth
- CVE-2023-37960Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files froMaven · com.mathworks.polyspace.jenkins:mathworks-polyspace