Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-31286An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0.NuGet · serenity.net.core, serenity.net.web · fixed in 6.7.0
- CVE-2023-31287An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0.NuGet · serenity.net.core, serenity.net.web · fixed in 6.7.0
- CVE-2023-30626Jellyfin vulnerable to directory traversal and file write causing arbitrary code executionNuGet · jellyfin.controller · fixed in 10.8.10
- CVE-2023-28260.NET DLL Hijacking Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm, microsoft.netcore.app.runtime.win-arm64 +2 · fixed in 7.0.5, 6.0.16
- CVE-2023-28638Stack references to locations outside buffers may become invalid if they exist during a GC compaction in SnappierNuGet · snappier · fixed in 1.1.1
- CVE-2023-1289A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 13.0.0
- CVE-2022-23535LiteDB contains Deserialization of Untrusted DataNuGet · litedb · fixed in 5.0.13
- CVE-2022-48282Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code executionNuGet · mongodb.driver · fixed in 2.19.0
- CVE-2023-21808.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm, microsoft.netcore.app.runtime.win-arm64 +2 · fixed in 7.0.3, 6.0.14
- CVE-2023-21893Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server.NuGet · oracle.manageddataaccess, oracle.manageddataaccess.core · fixed in 21.9.0, 19.18.0, 3.21.90 and more
- CVE-2023-21538.NET Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 6.0.13
- CVE-2020-36620Brondahl EnumStringValues EnumExtensions.cs GetStringValuesWithPreferences_Uncache resource consumptionNuGet · enumstringvalues · fixed in 4.0.2
- CVE-2021-4248kapetan dns Request.cs entropyNuGet · dns · fixed in 7.0.0
- CVE-2022-41089.NET Framework Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 6.0.12, 7.0.1, 3.1.32
- CVE-2022-23494Cross-site scripting vulnerability in TinyMCE alertsNuGet · tinymce · fixed in 6.3.1, 5.10.7
- CVE-2022-41954Temporary File Information Disclosure VulnerabilityNuGet · net.sf.mpxj, net.sf.mpxj-for-csharp +1 · fixed in 10.14.1
- CVE-2022-41064.NET Framework Information Disclosure VulnerabilityNuGet · microsoft.data.sqlclient, system.data.sqlclient · fixed in 1.1.4, 2.1.2, 4.8.5
- CVE-2022-41032NuGet Client Elevation of Privilege VulnerabilityNuGet · nuget.commandline, nuget.commands +1 · fixed in 4.9.6, 5.7.3, 5.9.3 and more
- CVE-2022-32173OrchardCore - HTML InjectionNuGet · orchardcore · fixed in 1.4.0
- CVE-2022-2922Relative Path Traversal in dnnsoftware/dnn.platformNuGet · dotnetnuke.core, dotnetnuke.web · fixed in 9.11.0
- CVE-2022-39256Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.NuGet · compositec1.core · fixed in 6.13
- CVE-2022-38013.NET Core and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 3.1.29, 6.0.9
- CVE-2022-33916OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information.NuGet · opcfoundation.netstandard.opc.ua.server · fixed in 1.4.370.9
- CVE-2022-35909In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.NuGet · jellyfin.common · fixed in 10.8.0
- CVE-2022-35540Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.NuGet · agileconfig.client · fixed in 1.6.8
- CVE-2022-34716.NET Spoofing VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +11 · fixed in 3.1.28, 6.0.8, 4.7.1 and more
- CVE-2022-31160jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelNuGet · jquery.ui.combined · fixed in 1.13.2
- CVE-2022-30187Azure Storage Library Information Disclosure VulnerabilityNuGet · azure.storage.blobs, azure.storage.queues · fixed in 12.13.0, 12.11.0
- CVE-2022-31129Inefficient Regular Expression Complexity in momentNuGet · moment.js · fixed in 2.29.4
- CVE-2022-29866OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggersNuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.4.368.58