Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-34464XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent templateMaven · org.xwiki.platform:xwiki-platform-web, org.xwiki.platform:xwiki-platform-web-templates · fixed in 14.4.8, 14.10.5, 15.1-rc-1
- CVE-2023-31469Apache StreamPipes: Privilege escalation through non-admin userMaven · org.apache.streampipes:streampipes-parent · fixed in 0.92.0
- CVE-2023-34462netty-handler SniHandler 16MB allocationMaven · io.netty:netty-handler · fixed in 4.1.94.Final
- CVE-2023-25500Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1Maven · com.vaadin:flow-server, com.vaadin:vaadin · fixed in 1.0.21, 2.9.3, 9.1.2 and more
- CVE-2023-25499Possible information disclosure in non visible componentsMaven · com.vaadin:flow-server, com.vaadin:vaadin · fixed in 1.0.20, 2.8.10, 9.1.1 and more
- CVE-2023-34981Apache Tomcat: AJP response header mix-upMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 11.0.0-M6, 10.1.9, 9.0.75 and more
- CVE-2023-34340Apache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentialsMaven · org.apache.accumulo:accumulo-shell · fixed in 2.1.1
- CVE-2023-33725Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customerMaven · org.broadleafcommerce:broadleaf · fixed in 6.2.7-GA
- CVE-2023-35166Privilege escalation (PR) from account through TipsPanelMaven · org.xwiki.platform:xwiki-platform-help-ui · fixed in 14.10.5, 15.1-rc-1
- CVE-2020-21485Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browMaven · org.alluxio:alluxio-parent
- CVE-2023-3315Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the exiMaven · org.jenkins-ci.plugins:teamconcert · fixed in 2.4.2
- CVE-2023-34602JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modMaven · org.jeecgframework.boot:jeecg-boot-parent · fixed in 3.5.1
- CVE-2023-34603JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.moduMaven · org.jeecgframework.boot:jeecg-boot-parent · fixed in 3.5.1
- CVE-2023-35839A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.Maven · org.noear:solon · fixed in 2.3.3
- CVE-2023-3308whaleal IceFrog Aviator Template Engine deserializationMaven · com.whaleal.icefrog:icefrog-all
- CVE-2023-34659jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-34660jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-34455snappy-java's unchecked chunk length leads to DoSMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.1
- CVE-2023-34454snappy-java's Integer Overflow vulnerability in compress leads to DoSMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.1
- CVE-2023-34453snappy-java's Integer Overflow vulnerability in shuffle leads to DoSMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.1
- CVE-2023-3276Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referenceMaven · cn.hutool:hutool-core
- CVE-2023-35030Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and LiMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.3.77-ga77
- CVE-2023-35029Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 updateMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.3.77-ga77
- CVE-2023-3193Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.3.74-ga74
- CVE-2023-2976Use of temporary directory for file creation in `FileBackedOutputStream` in GuavaMaven · com.google.guava:guava · fixed in 32.0.0-android
- CVE-2023-35149A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permissiMaven · org.jenkins-ci.plugins:ease-plugin
- CVE-2023-35148A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to Maven · org.jenkins-ci.plugins:ease-plugin
- CVE-2023-35147Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowiMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-35146Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template WorkfloMaven · org.jenkins.plugin.templateworkflows:template-workflows
- CVE-2023-35145Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validMaven · org.jenkins-ci.plugins:sonargraph-integration