Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-33008Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scaleMaven · org.apache.johnzon:johnzon-mapper · fixed in 1.2.21
- CVE-2023-34150Apache Any23: Possible excessive allocation of resources reading input.Maven · org.apache.any23:apache-any23
- CVE-2023-33201Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.Maven · org.bouncycastle:bcprov-debug-jdk14, org.bouncycastle:bcprov-debug-jdk15on +10 · fixed in 1.74
- CVE-2023-2974Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocolMaven · io.quarkus:quarkus-core · fixed in 2.16.8.Final
- CVE-2023-36812Remote Code Execution in OpenTSDBMaven · net.opentsdb:opentsdb · fixed in 2.4.2
- CVE-2023-36477Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki PlatformMaven · org.xwiki.contrib:application-ckeditor-ui, org.xwiki.platform:xwiki-platform-ckeditor-ui · fixed in 1.64.9, 14.10.6, 15.1
- CVE-2023-36468Upgrading doesn't prevent exploiting vulnerable XWiki documentsMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.7, 15.2-rc-1
- CVE-2023-36469Code injection through NotificationRSSService in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-notifications-ui · fixed in 14.10.6, 15.2-rc-1
- CVE-2023-36470Code injection in icon themes of XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-icon-default, org.xwiki.platform:xwiki-platform-icon-script +1 · fixed in 14.10.6, 15.2-rc-1
- CVE-2023-36471HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xmlMaven · org.xwiki.commons:xwiki-commons-xml · fixed in 14.10.6, 15.2-rc-1
- CVE-2023-28857LDAP password leak in Apereo CAS - GHSL-2023-009Maven · org.apereo.cas:cas-server-support-x509-core · fixed in 6.6.6
- CVE-2023-3432Server-Side Request Forgery (SSRF) in plantuml/plantumlMaven · net.sourceforge.plantuml:plantuml, net.sourceforge.plantuml:plantuml-mit · fixed in 1.2023.9
- CVE-2023-3431Improper Access Control in plantuml/plantumlMaven · net.sourceforge.plantuml:plantuml-mit · fixed in 1.2023.9
- CVE-2021-31635Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template fMaven · com.jfinal:jfinal
- CVE-2023-35162XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions templateMaven · org.xwiki.platform:xwiki-platform-flamingo-skin-resources · fixed in 14.10.5, 15.1-rc-1
- CVE-2023-35161XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication pageMaven · org.xwiki.platform:xwiki-platform-appwithinminutes-ui · fixed in 14.10.5, 15.1-rc-1
- CVE-2023-35160XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit templateMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.10.5, 15.1-rc-1
- CVE-2023-35159XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace templateMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.10.5, 15.1-rc-1
- CVE-2023-35158XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore templateMaven · org.xwiki.platform:xwiki-platform-flamingo-skin-resources · fixed in 14.10.5, 15.1-rc-1
- CVE-2023-35157XWiki Platform vulnerable to reflected cross-site scripting via delattachment actionMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.6, 15.1-rc-1
- CVE-2023-35156XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete templateMaven · org.xwiki.platform:xwiki-platform-flamingo-skin-resources · fixed in 14.10.6, 15.1
- CVE-2023-35155XWiki Platform vulnerable to cross-site scripting in target parameter via share page by emailMaven · org.xwiki.platform:xwiki-platform-sharepage-api · fixed in 14.4.8, 14.10.4
- CVE-2023-35153XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parametersMaven · org.xwiki.platform:xwiki-platform-appwithinminutes-ui · fixed in 14.4.8, 14.10.4, 15.0
- CVE-2023-35152XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResultsMaven · org.xwiki.platform:xwiki-platform-like-ui · fixed in 14.4.8, 14.10.6, 15.1
- CVE-2023-35151XWiki Platform may show email addresses in clear in REST resultsMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 14.4.8, 14.10.6, 15.1
- CVE-2023-35150XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationMaven · org.xwiki.platform:xwiki-platform-invitation-ui · fixed in 14.4.8, 14.10.4, 15.0
- CVE-2023-34467XWiki Platform may retrieve email addresses of all users Maven · org.xwiki.platform:xwiki-platform-livetable-ui · fixed in 14.4.8, 14.10.4
- CVE-2023-34466XWiki Platform's tags on non-viewable pages can be revealed to usersMaven · org.xwiki.platform:xwiki-platform-tag-api · fixed in 14.4.8, 14.10.4
- CVE-2023-34465XWiki Platform's Mail.MailConfig can be edited by any user with edit rightsMaven · org.xwiki.platform:xwiki-platform-mail-send-default · fixed in 14.4.8, 14.10.6, 15.1
- CVE-2023-35925FastAsyncWorldEdit vulnerable to Uncontrolled Resource ConsumptionMaven · com.fastasyncworldedit:fastasyncworldedit-bukkit, com.fastasyncworldedit:fastasyncworldedit-core · fixed in 2.6.3