Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-21643Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerabilityNuGet · microsoft.identitymodel.protocols.signedhttprequest · fixed in 6.34.0, 7.1.2
- CVE-2024-21319Microsoft Identity Denial of service vulnerabilityNuGet · microsoft.identitymodel.jsonwebtokens, system.identitymodel.tokens.jwt · fixed in 5.7.0, 6.34.0, 7.1.2
- CVE-2024-0057NET, .NET Framework, and Visual Studio Security Feature Bypass VulnerabilityNuGet · nuget.commandline, nuget.packaging · fixed in 5.11.6, 6.0.6, 6.3.4 and more
- CVE-2024-0056Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass VulnerabilityNuGet · microsoft.data.sqlclient, system.data.sqlclient · fixed in 2.1.7, 3.1.5, 4.0.5 and more
- CVE-2024-21911Cross-site scripting vulnerability in TinyMCENuGet · tinymce · fixed in 5.6.0
- CVE-2024-21910Cross-site scripting vulnerability in TinyMCE pluginsNuGet · tinymce · fixed in 5.10.0
- CVE-2024-21909Denial of service in CBOR libraryNuGet · petero.cbor · fixed in 4.5.1
- CVE-2024-21908Cross-site scripting vulnerability in TinyMCENuGet · tinymce · fixed in 5.9.0
- CVE-2024-21907Improper Handling of Exceptional Conditions in Newtonsoft.JsonNuGet · newtonsoft.json · fixed in 13.0.1
- CVE-2023-51652OWASP.AntiSamy mXSS when preserving commentsNuGet · owasp.antisamy · fixed in 1.2.0
- CVE-2023-51662Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)NuGet · snowflake.data · fixed in 2.1.5
- CVE-2023-49279Umbraco CMS vulnerable to stored XSS via SVG File UploadNuGet · umbraco.cms · fixed in 7.15.11, 8.18.9, 10.7.0 and more
- CVE-2023-49278Umbraco CMS brute force exploit can be used to collect valid usernamesNuGet · umbraco.cms · fixed in 8.18.10, 10.8.1, 12.3.4
- CVE-2023-49274Umbraco CMS SMTP misconfiguration exposes potential registered user emailNuGet · umbraco.cms · fixed in 8.18.10, 10.8.1, 12.3.4
- CVE-2023-49273Umbraco CMS vulnerable to Privilege Escalation using SpoofingNuGet · umbraco.cms · fixed in 8.18.10, 10.8.1, 12.3.4
- CVE-2023-49089Umbraco CMS possible path traversal when creating packages from backofficeNuGet · umbraco.cms · fixed in 8.18.10, 10.8.1, 12.3.4
- CVE-2023-48313Umbraco contains a DOM-XSSNuGet · umbraco.cms · fixed in 10.8.1, 12.3.4
- CVE-2023-48227Umbraco CMS Backoffice User can bypass "Publish" restrictionNuGet · umbraco.cms · fixed in 8.18.10, 10.8.0, 12.3.0
- CVE-2023-38694Umbraco CMS vulnerable to possible injection of HTML in an unintended formNuGet · umbraco.cms · fixed in 8.18.10, 10.7.0, 12.1.0
- CVE-2023-31048The OPC UA .NET Standard Reference Server before 1.4.371.86.NuGet · opcfoundation.netstandard.opc.ua.core, opcfoundation.netstandard.opc.ua.server · fixed in 1.4.371.86
- CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alNuGet · pubnub · fixed in 6.19.0
- CVE-2023-49289Cross-site Scripting in Ajax.NET ProfessionalNuGet · ajaxnetprofessional · fixed in 21.12.22.1
- CVE-2021-22143Elastic APM .NET Agent information disclosureNuGet · elastic.apm · fixed in 1.10.0
- CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCENuGet · tinymce · fixed in 5.10.9, 6.7.3
- CVE-2023-36558ASP.NET Core Security Feature Bypass VulnerabilityNuGet · microsoft.aspnetcore.components · fixed in 8.0.0, 7.0.14, 6.0.25
- CVE-2023-36049.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityNuGet · system.net.requests · fixed in 8.0.0, 6.0.25, 7.0.14
- CVE-2023-45818Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave pluginNuGet · tinymce · fixed in 6.7.1, 5.10.8
- CVE-2023-45819Cross-site Scripting vulnerability in TinyMCE notificationManager.open APINuGet · tinymce · fixed in 6.7.1, 5.10.8
- CVE-2023-45814Tokens cached in the AuthenticationService are susceptible to reuse in BunkumNuGet · bunkum · fixed in 4.2.1
- CVE-2023-36414Azure Identity SDK Remote Code Execution VulnerabilityNuGet · azure.identity · fixed in 1.10.2