Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25296Prototype Pollutionnpm · bodymen
- CVE-2022-23812Malicious Packagenpm · node-ipc · fixed in 10.1.3
- CVE-2021-23648Cross-site Scripting (XSS)npm · @braintree/sanitize-url · fixed in 6.0.0
- CVE-2022-21164Denial of Service (DoS)npm · node-lmdb · fixed in 0.9.7
- CVE-2021-45851A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the servnpm · @frangoteam/fuxa
- CVE-2022-24728Cross-site Scripting in CKEditor4npm · ckeditor4 · fixed in 4.18.0
- CVE-2022-24729Regular expression Denial of Service in dialog pluginnpm · ckeditor4 · fixed in 4.18.0
- CVE-2022-24762Exposure of Sensitive Information to an Unauthorized Actor in sysend.jsnpm · sysend · fixed in 1.10.0
- CVE-2022-24740Improper Authentication in Voltonpm · @plone/volto · fixed in 15.0.0-alpha.0
- CVE-2022-0341Cross-site Scripting (XSS) - Stored in vanessa219/vditornpm · vditor · fixed in 3.8.11
- CVE-2022-24760Command Injection in Parse servernpm · parse-server · fixed in 4.10.7
- CVE-2022-25839Improper Input Validationnpm · url-js · fixed in 2.1.0
- CVE-2022-24433Command Injectionnpm · simple-git · fixed in 3.3.0
- CVE-2021-46708The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim.npm · swagger-ui-dist · fixed in 4.1.3
- CVE-2018-25031Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.npm · swagger-ui · fixed in 4.1.3
- CVE-2022-0868Open Redirect in medialize/uri.jsnpm · urijs · fixed in 1.19.10
- CVE-2021-46704In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/unpm · genieacs · fixed in 1.2.8
- CVE-2022-24725Exposure of home directory through shescape on Unix with Bashnpm · shescape · fixed in 1.5.1
- CVE-2022-24723Improper Input Validation in URI.jsnpm · urijs · fixed in 1.19.9
- CVE-2022-0841OS Command Injection in ljharb/npm-lockfilenpm · npm-lockfile · fixed in 2.0.5
- CVE-2022-0528Server-Side Request Forgery (SSRF) in transloadit/uppynpm · @uppy/companion · fixed in 3.3.1
- CVE-2022-24719Unauthorized forwarding of confidential headers in fluture-nodenpm · fluture-node · fixed in 4.0.2
- CVE-2022-24718Path Traversal in ssr-pagesnpm · @finastra/ssr-pages · fixed in 0.1.4
- CVE-2022-24717Cross Site Scripting (XSS) in ssr-pagesnpm · @finastra/ssr-pages · fixed in 0.1.5
- CVE-2022-0776Cross-site Scripting (XSS) - DOM in hakimel/reveal.jsnpm · reveal.js · fixed in 4.3.0
- CVE-2022-0764Arbitrary Command Injection in strapi/strapinpm · strapi · fixed in 4.1.0
- CVE-2021-23495Open Redirectnpm · karma · fixed in 6.3.16
- CVE-2021-37504A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary npm · jquery-file-upload
- CVE-2022-24709Cross site scripting in @awsui/components-reactnpm · @awsui/components-react · fixed in 3.0.367
- CVE-2022-0654Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retrynpm · requestretry · fixed in 7.0.0