Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-34071Open Redirect Bypass Protection NuGet · umbraco.cms.web.backoffice, umbracocms.core · fixed in 8.18.14, 10.8.6, 12.3.10 and more
- CVE-2024-30054Microsoft Power BI Client JavaScript SDK Information Disclosure VulnerabilityNuGet · microsoft.powerbi.javascript
- CVE-2024-30046Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 7.0.19, 8.0.5
- CVE-2024-30045.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 7.0.19, 8.0.5
- CVE-2024-32655Npgsql Vulnerable to SQL Injection via Protocol Message Size OverflowNuGet · npgsql · fixed in 8.0.3, 4.0.14, 4.1.13 and more
- CVE-2024-29857An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA beforeNuGet · bouncycastle, bouncycastle.cryptography · fixed in 2.3.1
- CVE-2024-30171An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.NuGet · bouncycastle, bouncycastle.cryptography · fixed in 2.3.1
- CVE-2024-30172An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.NuGet · bouncycastle, bouncycastle.cryptography · fixed in 2.3.1
- CVE-2023-27321OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service VulnerabilityNuGet · opcfoundation.netstandard.opc.ua.server · fixed in 1.4.371.86
- CVE-2024-32872Umbraco Workflow's Backoffice users can execute arbitrary SQLNuGet · plumber.workflow, umbraco.workflow · fixed in 10.1.2, 10.3.9, 12.2.6 and more
- CVE-2024-29035Umbraco's Blind SSRF Leads to Port Scan by using WebhooksNuGet · umbraco.cms.core, umbraco.cms.web.backoffice · fixed in 13.1.1
- CVE-2024-27086MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of serviceNuGet · microsoft.identity.client · fixed in 4.59.1, 4.60.3
- CVE-2024-32036SixLabors.ImageSharp vulnerable to data leakageNuGet · sixlabors.imagesharp · fixed in 2.1.8, 3.1.4
- CVE-2024-32035Memory Allocation with Excessive Size Value in SixLabors.ImageSharpNuGet · sixlabors.imagesharp · fixed in 2.1.8, 3.1.4
- CVE-2024-32028Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreNuGet · opentelemetry.instrumentation.aspnetcore, opentelemetry.instrumentation.http · fixed in 1.8.1
- CVE-2024-29992Azure Identity Library for .NET Information Disclosure VulnerabilityNuGet · azure.identity · fixed in 1.11.0
- CVE-2024-21409.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 6.0.29, 8.0.4, 7.0.18
- CVE-2024-29881TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementsNuGet · tinymce · fixed in 7.0.0
- CVE-2024-29203TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframesNuGet · tinymce · fixed in 6.8.1
- CVE-2024-29188Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated filesNuGet · wix, wixtoolset.util.wixext · fixed in 3.14.1, 4.0.5
- CVE-2024-29187WiX based installers are vulnerable to binary hijack when run as SYSTEMNuGet · wix, wixtoolset.sdk · fixed in 3.14.1, 4.0.5
- CVE-2024-28868Umbraco possible user enumeration vulnerabilityNuGet · umbracocms · fixed in 10.8.5
- CVE-2024-28252CoreWCF NetFraming based services can leave connections open when they should be closedNuGet · corewcf.netframingbase · fixed in 1.4.2, 1.5.2
- CVE-2024-21392.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 7.0.17, 8.0.3
- CVE-2024-27929Use After Free in SixLabors.ImageSharpNuGet · sixlabors.imagesharp · fixed in 3.1.3, 2.1.7
- CVE-2024-26470A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackeNuGet · fullstackhero.webapi.boilerplate
- CVE-2024-26318Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.NuGet · serenity.net.core · fixed in 6.8.0
- CVE-2024-21386.NET Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 6.0.27, 7.0.16, 8.0.2
- CVE-2024-24810WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privilegesNuGet · wix · fixed in 4.0.4, 3.14.0
- CVE-2024-23838TrueLayer.Client SSRF when fetching payment or payment providerNuGet · truelayer.client · fixed in 1.6.0