Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-22138Denial of Service (DoS)npm · fast-string-search
- CVE-2022-21213Prototype Pollutionnpm · mout · fixed in 1.2.4
- CVE-2022-25345Denial of Service (DoS)npm · @discordjs/opus · fixed in 0.8.0
- CVE-2022-31083Authentication bypass in Parse Server Apple Game Center auth adapter npm · parse-server · fixed in 4.10.11, 5.2.2
- CVE-2021-33295Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitinpm · joplin · fixed in 1.8.5
- CVE-2022-31070Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxynpm · @finastra/nestjs-proxy · fixed in 0.7.0
- CVE-2022-31069Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxynpm · @finastra/nestjs-proxy · fixed in 0.7.0
- CVE-2022-2079Cross-site Scripting (XSS) - Stored in nocodb/nocodbnpm · nocodb · fixed in 0.91.9
- CVE-2022-29257Electron's AutoUpdater module fails to validate certain nested components of the bundlenpm · electron · fixed in 15.5.0, 16.2.0, 17.2.0 and more
- CVE-2022-29247Exposure of Resource to Wrong Sphere in Electronnpm · electron · fixed in 15.5.5, 16.2.6, 17.2.0 and more
- CVE-2022-29244npm packing does not respect root-level ignore files in workspacesnpm · npm · fixed in 8.11.0
- CVE-2022-2064Insufficient Session Expiration in nocodb/nocodbnpm · nocodb · fixed in 0.91.9
- CVE-2022-2063Improper Privilege Management in nocodb/nocodbnpm · nocodb · fixed in 0.91.8
- CVE-2022-29894Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function.npm · strapi
- CVE-2022-2062Generation of Error Message Containing Sensitive Information in nocodb/nocodbnpm · nocodb · fixed in 0.91.7
- CVE-2022-25851Denial of Service (DoS)npm · jpeg-js · fixed in 0.4.4
- CVE-2022-21211Denial of Service (DoS)npm · posix
- CVE-2022-24278Directory Traversalnpm · convert-svg-core · fixed in 0.6.4
- CVE-2022-24376Command Injectionnpm · git-promise
- CVE-2022-24429Arbitrary Code Injectionnpm · convert-svg-core · fixed in 0.6.3
- CVE-2022-25863Deserialization of Untrusted Datanpm · gatsby-plugin-mdx · fixed in 2.14.1, 3.15.2
- CVE-2022-31051Exposure of Sensitive Information to an Unauthorized Actor in semantic-releasenpm · semantic-release · fixed in 19.0.3
- CVE-2022-31830Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.npm · kityminder
- CVE-2022-21122Arbitrary Code Executionnpm · metacalc · fixed in 0.0.2
- CVE-2022-1929Exponential ReDoS in devcertnpm · devcert · fixed in 1.2.1
- CVE-2021-43308Exponential ReDoS in markdown-link-extractornpm · markdown-link-extractor · fixed in 3.0.2, 4.0.1
- CVE-2021-43307Exponential ReDoS in semver-regexnpm · semver-regex · fixed in 3.1.4, 4.0.3
- CVE-2021-43306Exponential ReDoS in jquery-validationnpm · jquery-validation · fixed in 1.19.4
- CVE-2021-34078lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's packagnpm · lifion-verify-deps · fixed in 1.2.0
- CVE-2021-34079OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacnpm · docker-tester