Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-37959A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect Maven · org.jenkins-ci.plugins:sumologic-publisher
- CVE-2023-37958A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an Maven · org.jenkins-ci.plugins:sumologic-publisher
- CVE-2023-37957A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an Maven · io.jenkins.plugins:pipeline-restful-api
- CVE-2023-37956A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to conMaven · org.jenkins-ci.plugins:test-results-aggregator
- CVE-2023-37955A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect tMaven · org.jenkins-ci.plugins:test-results-aggregator · fixed in 1.2.16
- CVE-2023-37954A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a Maven · com.sonyericsson.hudson.plugins.rebuild:rebuild
- CVE-2023-37953A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attackerMaven · com.mabl.integration.jenkins:mabl-integration · fixed in 0.0.47
- CVE-2023-37952A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-speciMaven · com.mabl.integration.jenkins:mabl-integration · fixed in 0.0.47
- CVE-2023-37951Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure pMaven · com.mabl.integration.jenkins:mabl-integration · fixed in 0.0.47
- CVE-2023-37950A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials Maven · com.mabl.integration.jenkins:mabl-integration · fixed in 0.0.47
- CVE-2023-37949A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect toMaven · io.jenkins.plugins:macstadium-orka · fixed in 1.34
- CVE-2023-37948Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling mMaven · org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute · fixed in 1.0.17
- CVE-2023-37947Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pMaven · org.openshift.jenkins:openshift-login · fixed in 1.1.0.230.v5d7030b
- CVE-2023-37946Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.Maven · org.openshift.jenkins:openshift-login · fixed in 1.1.0.230.v5d7030b
- CVE-2023-37945A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/ReaMaven · io.jenkins.plugins:miniorange-saml-sp · fixed in 2.3.1
- CVE-2023-37944A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attackMaven · org.datadog.jenkins.plugins:datadog · fixed in 5.4.2
- CVE-2023-37943Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test toMaven · org.jenkins-ci.plugins:active-directory · fixed in 2.30.1
- CVE-2023-37942Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (Maven · org.jenkins-ci.plugins:external-monitor-job · fixed in 207.v98a
- CVE-2022-45855Apache Ambari: Allows authenticated metrics consumers to perform RCEMaven · org.apache.ambari:ambari · fixed in 2.7.7
- CVE-2022-42009Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.Maven · org.apache.ambari:ambari · fixed in 2.7.7
- CVE-2023-37582Apache RocketMQ: Possible remote code execution when using the update configuration functionMaven · org.apache.rocketmq:rocketmq-namesrv · fixed in 4.9.7, 5.1.2
- CVE-2023-30428Apache Pulsar Broker: Incorrect Authorization Validation for Rest ProducerMaven · org.apache.pulsar:pulsar-broker · fixed in 2.10.4, 2.11.1
- CVE-2023-30429Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar ProxyMaven · org.apache.pulsar:pulsar · fixed in 2.10.4, 2.11.1
- CVE-2023-31007Apache Pulsar: Broker does not always disconnect client when authentication data expiresMaven · org.apache.pulsar:pulsar-broker · fixed in 2.10.4, 2.11.1
- CVE-2023-37579Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source CredentialsMaven · org.apache.pulsar:pulsar-functions-worker · fixed in 2.10.4, 2.11.1
- CVE-2023-32200Apache Jena: Exposure of execution in script engine expressions.Maven · org.apache.jena:jena · fixed in 4.9.0
- CVE-2023-37277XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST APIMaven · com.xpn.xwiki.platform:xwiki-core-rest-server, com.xpn.xwiki.platform:xwiki-rest +1 · fixed in 14.10.8, 15.2
- CVE-2023-34442Apache Camel JIRA: Temporary file information disclosure in Camel-JiraMaven · org.apache.camel:camel-jira · fixed in 3.14.9, 3.18.8, 3.20.6 and more
- CVE-2023-35887Apache MINA SSHD: Information disclosure bugs with RootedFilesystemMaven · org.apache.sshd:sshd-common, org.apache.sshd:sshd-core +1 · fixed in 2.9.3, 2.1.0
- CVE-2022-4361Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC provideMaven · org.keycloak:keycloak-services · fixed in 21.1.2