Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-30601Apache Cassandra: Privilege escalation when enabling FQL/Audit logsMaven · org.apache.cassandra:cassandra-all · fixed in 4.1.2, 4.0.10
- CVE-2023-32315Openfire administration console authentication bypassMaven · org.igniterealtime.openfire:xmppserver · fixed in 4.6.8, 4.7.5
- CVE-2023-1664A flaw was found in Keycloak.Maven · org.keycloak:keycloak-core · fixed in 21.1.2
- CVE-2023-20883In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential forMaven · org.springframework.boot:spring-boot-autoconfigure · fixed in 3.0.7, 2.7.12, 2.6.15 and more
- CVE-2023-33779A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crMaven · com.xuxueli:xxl-job
- CVE-2023-2798Denial of service in HtmlUnitMaven · org.htmlunit:htmlunit · fixed in 2.70.0
- CVE-2022-46907Apache JSPWiki: XSS Injection points in several pluginsMaven · org.apache.jspwiki:jspwiki-main, org.apache.jspwiki:jspwiki-war · fixed in 2.12.0
- CVE-2023-33950Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.77
- CVE-2023-33949In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email Maven · com.liferay.portal:release.portal.bom · fixed in 7.3.1
- CVE-2023-33948The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.68
- CVE-2023-33947The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.61
- CVE-2023-33946The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in differenMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.49
- CVE-2023-33945SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before updatMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.18
- CVE-2023-33944Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, anMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.69
- CVE-2023-33943Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 thMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.63
- CVE-2023-33942Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and LiferaMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.51
- CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionMaven · org.apache.rocketmq:rocketmq-broker, org.apache.rocketmq:rocketmq-controller +1 · fixed in 5.1.1, 4.9.6
- CVE-2023-33941Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.53
- CVE-2023-33940Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before updMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.31
- CVE-2023-33939Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.13
- CVE-2023-33938Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and LMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.1
- CVE-2023-33937Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 befoMaven · com.liferay.portal:release.portal.bom · fixed in 7.3.1
- CVE-2023-32697Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlledMaven · org.xerial:sqlite-jdbc · fixed in 3.41.2.2
- CVE-2023-31826Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages.Maven · org.skyscreamer:nevado-jms
- CVE-2023-31062Apache InLong: Privilege escalation vulnerability for InLongMaven · org.apache.inlong:manager-dao, org.apache.inlong:manager-pojo +2 · fixed in 1.7.0
- CVE-2023-31064Apache InLong: Insecurity direct object references cancelling applicationsMaven · org.apache.inlong:manager-workflow · fixed in 1.7.0
- CVE-2023-31065Apache InLong: Insufficient Session Expiration in InLongMaven · org.apache.inlong:manager-dao, org.apache.inlong:manager-pojo +2 · fixed in 1.7.0
- CVE-2023-31066Apache InLong: Insecure direct object references for inlong sourcesMaven · org.apache.inlong:manager-service, org.apache.inlong:manager-web · fixed in 1.7.0
- CVE-2023-31098Apache InLong: Weak Password Implementation in InLongMaven · org.apache.inlong:manager-pojo · fixed in 1.47.0
- CVE-2023-31101Apache InLong: Users who joined later can see the data of deleted usersMaven · org.apache.inlong:manager-dao, org.apache.inlong:manager-pojo +2 · fixed in 1.7.0