Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-36566Microsoft Common Data Model SDK Denial of Service VulnerabilityNuGet · microsoft.commondatamodel.objectmodel · fixed in 1.7.4
- CVE-2023-36435Microsoft QUIC Denial of Service VulnerabilityNuGet · microsoft.native.quic.msquic.openssl, microsoft.native.quic.msquic.schannel · fixed in 2.2.3
- CVE-2023-38171Microsoft QUIC Denial of Service VulnerabilityNuGet · microsoft.native.quic.msquic.openssl, microsoft.native.quic.msquic.schannel · fixed in 2.2.3
- CVE-2023-44390HtmlSanitizer vulnerable to Cross-site Scripting in Foreign ContentNuGet · htmlsanitizer · fixed in 8.0.723, 8.1.722-beta
- CVE-2023-41890Sustainsys.Saml2 Insufficient Identity Provider Issuer ValidationNuGet · kentor.authservices, sustainsys.saml2 · fixed in 1.0.3, 2.9.2
- CVE-2023-36792Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm64, microsoft.netcore.app.runtime.win-x64 +1 · fixed in 7.0.11, 6.0.22
- CVE-2023-36793Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm64, microsoft.netcore.app.runtime.win-x64 +1 · fixed in 7.0.11, 6.0.22
- CVE-2023-36794Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm64, microsoft.netcore.app.runtime.win-x64 +1 · fixed in 7.0.11, 6.0.22
- CVE-2023-36796Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm64, microsoft.netcore.app.runtime.win-x64 +1 · fixed in 7.0.11, 6.0.22
- CVE-2023-36799.NET Core and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +4 · fixed in 7.0.11, 6.0.22
- CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +5 · fixed in 13.3.0, 2.88.6
- CVE-2023-38180.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.win-arm64, microsoft.aspnetcore.app.runtime.win-x64 +3 · fixed in 7.0.10, 6.0.21, 2.1.40
- CVE-2023-35391ASP.NET Core SignalR and Visual Studio Information Disclosure VulnerabilityNuGet · microsoft.aspnetcore.signalr.redis, microsoft.aspnetcore.signalr.stackexchangeredis · fixed in 1.0.40, 7.0.10, 6.0.21
- CVE-2023-38178.NET Core and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.win-arm, microsoft.aspnetcore.app.runtime.win-arm64 +6 · fixed in 7.0.10
- CVE-2023-35390.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.net.build.containers · fixed in 7.0.307
- CVE-2023-37267Umbraco allows possible Admin-level access to backoffice without Auth under rare conditionsNuGet · umbraco.cms.infrastructure, umbraco.cms.web.backoffice · fixed in 10.6.1, 11.4.2, 12.0.1
- CVE-2023-33170ASP.NET and Visual Studio Security Feature Bypass VulnerabilityNuGet · microsoft.aspnet.identity.owin, microsoft.aspnetcore.app.runtime.linux-arm +12 · fixed in 2.2.4, 6.0.20, 7.0.9 and more
- CVE-2023-33127.NET and Visual Studio Elevation of Privilege VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 7.0.9, 6.0.20
- CVE-2023-33141Yet Another Reverse Proxy (YARP) Denial of Service VulnerabilityNuGet · yarp.reverseproxy · fixed in 1.1.2, 2.0.1
- CVE-2023-32571Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods inNuGet · system.linq.dynamic.core · fixed in 1.3.0
- CVE-2023-29337NuGet Client Remote Code Execution VulnerabilityNuGet · microsoft.build.nugetsdkresolver, nuget.commandline +4 · fixed in 6.0.5, 6.2.4, 6.3.3 and more
- CVE-2023-29331.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +12 · fixed in 7.0.7, 6.0.18, 7.0.3 and more
- CVE-2023-24936.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 7.0.7, 6.0.18
- CVE-2023-24895.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 7.0.7, 6.0.18
- CVE-2023-24897.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm, microsoft.netcore.app.runtime.win-arm64 +2 · fixed in 7.0.7, 6.0.18
- CVE-2023-33128.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 7.0.7
- CVE-2023-33126.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm, microsoft.netcore.app.runtime.win-arm64 +2 · fixed in 7.0.7, 6.0.18
- CVE-2023-34230Snowflake Connector vulnerable to Command InjectionNuGet · snowflake.data · fixed in 2.0.18
- CVE-2023-2862SiteServer CMS search cross site scriptingNuGet · sscms
- CVE-2023-31285An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0.NuGet · serenity.net.core, serenity.net.services · fixed in 6.7.0