Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-29863OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.NuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.4.368.58
- CVE-2022-29864OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger UncontroNuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.4.368.58
- CVE-2022-29862An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.NuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.4.368.58
- CVE-2022-29865OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.NuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.4.368.58
- CVE-2022-30184.NET and Visual Studio Information Disclosure VulnerabilityNuGet · nuget.commandline, nuget.commandline.xplat +1 · fixed in 4.9.5, 5.2.1, 5.7.2 and more
- CVE-2022-29245Weak private key generation in SSH.NETNuGet · ssh.net · fixed in 2020.0.2
- CVE-2022-30349siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).NuGet · sscms
- CVE-2022-29362A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scNuGet · zkeacms.publisher
- CVE-2021-42656SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.NuGet · sscms
- CVE-2021-42655SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.NuGet · sscms
- CVE-2021-33318An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1NuGet · ipmatcher · fixed in 1.0.4.2
- CVE-2022-29145.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +9 · fixed in 3.1.25, 5.0.17, 6.0.5
- CVE-2022-29117.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +12 · fixed in 3.1.25, 5.0.17, 6.0.5 and more
- CVE-2022-23267.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 3.1.25, 5.0.17, 6.0.5
- CVE-2022-21167Arbitrary Code ExecutionNuGet · masuit.tools.core
- CVE-2022-26924YARP Denial of Service VulnerabilityNuGet · yarp.reverseproxy · fixed in 1.0.1, 1.1.0-rc.1.22211.2
- CVE-2022-26907Azure SDK for .NET Information Disclosure VulnerabilityNuGet · microsoft.rest.clientruntime · fixed in 2.3.24
- CVE-2022-26788PowerShell Elevation of Privilege VulnerabilityNuGet · microsoft.powershell.sdk · fixed in 7.0.10, 7.1.7, 7.2.3
- CVE-2022-24849Contact to DisCatSharp-owned server using authenticated clientNuGet · discatsharp · fixed in 9.9.1
- CVE-2022-0609Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cNuGet · cefsharp.common, cefsharp.common.netcore +7 · fixed in 98.1.210
- CVE-2022-24785Path Traversal in Moment.jsNuGet · moment.js · fixed in 2.29.2
- CVE-2022-24789 Deserialization of untrusted data in C1 CMS.NuGet · c1cms.assemblies · fixed in 6.12.8122.18346
- CVE-2022-0749Deserialization of Untrusted DataNuGet · singoocms.utility
- CVE-2022-24512.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.aot.linux-x64.cross.android-arm, microsoft.netcore.app.runtime.aot.linux-x64.cross.android-arm64 +113 · fixed in 6.0.3, 3.1.23, 5.0.15
- CVE-2022-24464.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 3.1.23, 5.0.15, 6.0.3
- CVE-2021-46703In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxNuGet · razorengine
- CVE-2022-23395jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).NuGet · jquery.cookie
- CVE-2022-21986.NET Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 5.0.14, 6.0.2
- CVE-2021-32841Path Traversal in SharpZipLibNuGet · sharpziplib · fixed in 1.3.3
- CVE-2021-32842Path Traversal in SharpZipLibNuGet · sharpziplib · fixed in 1.3.3