Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-31103Apache InLong: Attackers can change the immutable name and type of clusterMaven · org.apache.inlong:manager-dao, org.apache.inlong:manager-pojo +3 · fixed in 1.7.0
- CVE-2023-31206Apache InLong: Attackers can change the immutable name and type of nodesMaven · org.apache.inlong:manager-dao, org.apache.inlong:manager-pojo +3 · fixed in 1.7.0
- CVE-2023-31453Apache InLong: IDOR make users can delete others' subscriptionMaven · org.apache.inlong:manager-service, org.apache.inlong:manager-web · fixed in 1.7.0
- CVE-2023-31454Apache InLong: IDOR make users can bind any clusterMaven · org.apache.inlong:manager-service · fixed in 1.7.0
- CVE-2023-31058Apache InLong: JDBC URL bypassing by adding blanksMaven · org.apache.inlong:manager-common, org.apache.inlong:manager-pojo · fixed in 1.7.0
- CVE-2023-28709Apache Tomcat: Fix for CVE-2023-24998 is incompleteMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 11.0.0-M5, 10.1.8, 9.0.74 and more
- CVE-2023-33264In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuratioMaven · com.hazelcast:hazelcast · fixed in 5.0.5, 5.1.6, 5.2.4 and more
- CVE-2023-2631CSRF vulnerability and missing permission checks in Code Dx Plugin Maven · org.jenkins-ci.plugins:codedx · fixed in 4.0.0
- CVE-2023-2195CSRF vulnerability and missing permission checks in Code Dx Plugin Maven · org.jenkins-ci.plugins:codedx · fixed in 4.0.0
- CVE-2023-2633API keys stored and displayed in plain text by Code Dx Plugin Maven · org.jenkins-ci.plugins:codedx · fixed in 4.0.0
- CVE-2023-2632API keys stored and displayed in plain text by Code Dx Plugin Maven · org.jenkins-ci.plugins:codedx · fixed in 4.0.0
- CVE-2023-2196Missing permission checks in Code Dx Plugin Maven · org.jenkins-ci.plugins:codedx · fixed in 4.0.0
- CVE-2023-33007Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (Maven · org.jenkins-ci.plugins:loadcomplete
- CVE-2023-33006A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging Maven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-33005Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-33004A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler stMaven · org.jenkins-ci.plugins:tag-profiler
- CVE-2023-33003A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistiMaven · org.jenkins-ci.plugins:tag-profiler
- CVE-2023-33002Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scriptMaven · org.jenkins-ci.plugins:testcomplete
- CVE-2023-33001Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the buildMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin
- CVE-2023-33000Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, Maven · io.jenkins.plugins:cavisson-ns-nd-integration · fixed in 4.11.0.48
- CVE-2023-32999A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attMaven · com.rapid7:jenkinsci-appspider-plugin · fixed in 1.0.16
- CVE-2023-32998A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-Maven · com.rapid7:jenkinsci-appspider-plugin · fixed in 1.0.16
- CVE-2023-32997Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:cas-plugin · fixed in 1.6.3
- CVE-2023-32996A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to senMaven · io.jenkins.plugins:miniorange-saml-sp · fixed in 2.0.1
- CVE-2023-32995A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HMaven · io.jenkins.plugins:miniorange-saml-sp · fixed in 2.0.1
- CVE-2023-32994Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOraMaven · io.jenkins.plugins:miniorange-saml-sp · fixed in 2.2.0
- CVE-2023-32993Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configurMaven · io.jenkins.plugins:miniorange-saml-sp · fixed in 2.1.0
- CVE-2023-32992Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send Maven · io.jenkins.plugins:miniorange-saml-sp · fixed in 2.1.0
- CVE-2023-32991A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HMaven · io.jenkins.plugins:miniorange-saml-sp · fixed in 2.1.0
- CVE-2023-32990A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:azure-vm-agents · fixed in 853.v4a