Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-35144Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven RepoMaven · jenkins:repository
- CVE-2023-35143Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven RepoMaven · jenkins:repository
- CVE-2023-35142Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.Maven · com.checkmarx.jenkins:checkmarx · fixed in 2023.2.6
- CVE-2023-35141In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.400
- CVE-2023-34396Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart formsMaven · org.apache.struts:struts-core, org.apache.struts:struts2-core +1 · fixed in 2.5.31, 6.1.2.1
- CVE-2023-34149Apache Struts: DoS via OOM owing to not properly checking of list boundsMaven · org.apache.struts:struts2-core · fixed in 2.5.31, 6.1.2.1
- CVE-2023-34610An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thMaven · com.cedarsoftware:json-io · fixed in 4.14.1
- CVE-2023-34612An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object thaMaven · com.helger.commons:ph-json
- CVE-2023-34613An issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uMaven · net.sf.sojo:sojo
- CVE-2023-34614An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted obMaven · cc.plural:jsonij
- CVE-2023-34615An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatMaven · net.pwall.json:jsonutil
- CVE-2023-34616An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatMaven · com.progsbase.libraries:json
- CVE-2023-34617An issue was discovered genson thru 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uMaven · com.owlike:genson
- CVE-2023-34620An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that Maven · org.hjson:hjson · fixed in 3.0.1
- CVE-2023-34624An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted objecMaven · net.sourceforge.htmlcleaner:htmlcleaner · fixed in 2.29
- CVE-2023-35110An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that Maven · de.grobmeier.json:jjson
- CVE-2023-33695Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/iMaven · cn.hutool:hutool-core · fixed in 5.8.19
- CVE-2023-34212Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS ComponentsMaven · org.apache.nifi:nifi-jms-processors · fixed in 1.22.0
- CVE-2023-34468Apache NiFi: Potential Code Injection with Database Services using H2Maven · org.apache.nifi:nifi-dbcp-base, org.apache.nifi:nifi-dbcp-service-nar +1 · fixed in 1.22.0
- CVE-2023-35042GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteraMaven · org.geoserver:gs-wfs, org.geoserver:gs-wms +1 · fixed in 2.18.6, 2.19.6, 2.20.4
- CVE-2023-32731Information leak in gRPCMaven · io.grpc:grpc-protobuf · fixed in 1.53.1, 1.54.2
- CVE-2023-32732Denial-of-Service in gRPCMaven · io.grpc:grpc-protobuf · fixed in 1.53.1, 1.54.2
- CVE-2023-1428Denial-of-Service in gRPCMaven · io.grpc:grpc-protobuf · fixed in 1.53.0
- CVE-2023-3163y_project RuoYi filterKeyword resource consumptionMaven · com.ruoyi:ruoyi
- CVE-2023-33496xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NeMaven · com.xuxueli:xxl-rpc-core
- CVE-2023-33510Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.Maven · org.jeecgframework.p3:jeecg-p3-biz-chat
- CVE-2023-32310DataEase API interface has IDOR vulnerabilityMaven · io.dataease:dataease-plugin-common · fixed in 1.18.7
- CVE-2023-33544hawtio 2.17.2 is vulnerable to Path Traversal.Maven · io.hawt:project
- CVE-2023-33546Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method.Maven · org.codehaus.janino:janino-parent
- CVE-2023-33962JStachio XSS vulnerability: Unescaped single quotesMaven · io.jstach:jstachio · fixed in 1.0.1