Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-39249Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsnpm · matrix-js-sdk · fixed in 19.7.0
- CVE-2022-39251Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusionnpm · matrix-js-sdk · fixed in 19.7.0
- CVE-2022-31367Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.npm · @strapi/strapi, strapi · fixed in 4.1.10, 3.6.10
- CVE-2022-21169Prototype Pollutionnpm · express-xss-sanitizer · fixed in 1.1.3
- CVE-2022-41340The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.npm · @lionello/secp256k1-js · fixed in 1.1.0
- CVE-2022-23461Cross-Site Scripting (XSS) in Jodit Editornpm · jodit
- CVE-2022-39239nefly-ipx subject to Server-Side Request Forgery and Stored Cross-Site Scripting via Cache Poisoning and Improper Host Validationnpm · @netlify/ipx · fixed in 1.2.3
- CVE-2022-39231Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumventednpm · parse-server · fixed in 4.10.16, 5.2.7
- CVE-2022-39230Security issue in fhir-works-on-aws-authz-smartnpm · fhir-works-on-aws-authz-smart · fixed in 3.1.3
- CVE-2022-39225Parse Server subject to Incorrect Resource Transfer Between Spheresnpm · parse-server · fixed in 4.10.15, 5.2.6
- CVE-2020-36604hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.npm · @hapi/hoek, hoek · fixed in 8.5.1, 9.0.3
- CVE-2022-23458Toast UI Grid vulnerable to Cross-site scriptingnpm · tui-grid · fixed in 4.21.3
- CVE-2022-39218Random number seed fixed during compilationnpm · @fastly/js-compute · fixed in 0.5.3
- CVE-2022-37265Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.npm · steal
- CVE-2022-37259A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.npm · steal
- CVE-2022-38545Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a npm · valine · fixed in 1.5.0
- CVE-2022-25873Cross-site Scripting (XSS)npm · vuetify · fixed in 2.6.10
- CVE-2022-37258Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convnpm · steal
- CVE-2022-3225Improper Control of Dynamically-Managed Code Resources in budibase/budibasenpm · @budibase/bbui, @budibase/builder +1 · fixed in 1.3.20
- CVE-2022-37260A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js.npm · steal
- CVE-2022-37264Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.npm · steal
- CVE-2022-37262A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.npm · steal
- CVE-2022-37257Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npmnpm · steal
- CVE-2022-37266Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.npm · steal
- CVE-2022-3224Misinterpretation of Input in ionicabizau/parse-urlnpm · parse-url · fixed in 8.1.0
- CVE-2022-2900Server-Side Request Forgery (SSRF) in ionicabizau/parse-urlnpm · parse-url · fixed in 8.1.0
- CVE-2022-39203Parsing issue in matrix-org/node-irc leading to room takeoversnpm · matrix-appservice-irc · fixed in 0.35.0
- CVE-2022-39202IRC mode parameter confusion in matrix-appservice-ircnpm · matrix-appservice-irc · fixed in 0.35.0
- CVE-2022-38639A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted npm · markdown-nice
- CVE-2022-36084cruddl vulnerable to AQL injection through flexSearchnpm · cruddl · fixed in 3.0.2, 2.7.0