Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-5217Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potennpm · electron · fixed in 22.3.25, 24.8.5, 25.8.4 and more
- CVE-2023-26149Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, vianpm · quill-mention · fixed in 4.0.0
- CVE-2023-43646Inefficient Regular Expression Complexity in get-func-namenpm · get-func-name · fixed in 2.0.1
- CVE-2023-42810systeminformation SSID Command Injection Vulnerabilitynpm · systeminformation · fixed in 5.21.7
- CVE-2023-5104Improper Input Validation in nocodb/nocodbnpm · nocodb · fixed in 0.96.0
- CVE-2023-31716FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.lognpm · @frangoteam/fuxa
- CVE-2023-31717A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.npm · fuxa-server
- CVE-2023-31718FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.npm · fuxa-server
- CVE-2023-31719FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.npm · fuxa-server
- CVE-2023-26144Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the Ovnpm · graphql · fixed in 16.8.1
- CVE-2023-26143Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API.npm · blamer · fixed in 1.0.4
- CVE-2023-42399Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via tnpm · jodit
- CVE-2023-33831A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands npm · @frangoteam/fuxa
- CVE-2023-38507Strapi Improper Rate Limiting vulnerabilitynpm · @strapi/admin, @strapi/plugin-users-permissions · fixed in 4.12.1
- CVE-2023-37263Strapi's field level permissions not being respected in relationship titlenpm · @strapi/plugin-content-manager · fixed in 4.12.1
- CVE-2023-36472Strapi may leak sensitive user information, user reset password, tokens via content-manager viewsnpm · @strapi/admin, @strapi/plugin-content-manager +1 · fixed in 4.11.7
- CVE-2023-41592Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.npm · froala-editor · fixed in 4.1.4
- CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bonpm · electron · fixed in 22.3.24, 24.8.3, 25.8.1 and more
- CVE-2023-39584Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.npm · hexo · fixed in 7.2.0
- CVE-2023-41646Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/npm · buttercup · fixed in 7.4.0
- CVE-2023-23623Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electronnpm · electron · fixed in 22.0.1, 23.0.0-alpha.2
- CVE-2023-29198Context isolation bypass via nested unserializable return value in Electronnpm · electron · fixed in 22.3.6, 23.2.3, 24.0.1 and more
- CVE-2023-39956Electron: Out-of-package code execution when launched with arbitrary cwdnpm · electron · fixed in 22.3.19, 23.3.13, 24.7.1 and more
- CVE-2023-41058Trigger `beforeFind` not invoked in internal query pipeline in parse-servernpm · parse-server · fixed in 5.5.5, 6.2.2
- CVE-2023-41049Improper Neutralization of Script in Attributes in @dcl/single-sign-on-clientnpm · @dcl/single-sign-on-client · fixed in 0.1.0
- CVE-2023-40582Command Injection Vulnerability in find-execnpm · find-exec · fixed in 1.0.3
- CVE-2023-41037Cleartext Signed Message Signature Spoofing in openpgpjsnpm · openpgp · fixed in 4.10.11, 5.10.1
- CVE-2021-32050Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an applicationnpm · mongodb · fixed in 3.6.10, 4.17.0, 5.8.0
- CVE-2023-39663Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the componnpm · mathjax
- CVE-2023-41167@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers.npm · @webiny/react-rich-text-renderer · fixed in 5.37.2