Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-32840Path Traversal in SharpZipLibNuGet · sharpziplib · fixed in 1.3.3
- CVE-2022-0274Cross-site Scripting (XSS) - Stored in orchardcms/orchardcoreNuGet · orchardcore.application.cms.targets · fixed in 1.2.2
- CVE-2022-22690Umbraco Remote ApplicationURL OverwriteNuGet · umbraco.cms.core · fixed in 9.2.0
- CVE-2022-22691Umbraco Password Reset URL PoisonNuGet · umbraco.cms.core · fixed in 9.2.0
- CVE-2022-0159Cross-site Scripting (XSS) - Stored in orchardcms/orchardcoreNuGet · orchardcore · fixed in 1.2.1
- CVE-2021-43045Possible DOS vulnerabilities in C# Avro SDKNuGet · apache.avro · fixed in 1.11.0
- CVE-2021-43853Cross-Site Scripting in AjaxNetProfessionalNuGet · ajaxnetprofessional · fixed in 21.12.22.1
- CVE-2021-23758Deserialization of Untrusted DataNuGet · ajaxnetprofessional · fixed in 21.11.29.1
- CVE-2021-25976Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)NuGet · piranha · fixed in 10.0-alpha1
- CVE-2021-42279Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore
- CVE-2021-43569The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows atNuGet · starkbank-ecdsa · fixed in 1.3.2
- CVE-2021-41238Missing Authorization with Default Settings in Dashboard UINuGet · hangfire.core · fixed in 1.7.26
- CVE-2021-41182XSS in the `altField` option of the Datepicker widgetNuGet · jquery.ui.combined · fixed in 1.13.0
- CVE-2021-41183XSS in `*Text` options of the Datepicker widgetNuGet · jquery.ui.combined · fixed in 1.13.0
- CVE-2021-41184XSS in the `of` option of the `.position()` utilNuGet · jquery.ui.combined · fixed in 1.13.0
- CVE-2021-25977Piranha CMS - Stored XSS in Page TitleNuGet · piranha · fixed in 9.2.0
- CVE-2021-41355.NET Core and Visual Studio Information Disclosure VulnerabilityNuGet · system.directoryservices.protocols · fixed in 5.0.1
- CVE-2021-31819In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already tNuGet · halibut · fixed in 4.4.7
- CVE-2021-39208WriteEntryToDirectory used for an archive extraction is vulnerable to partial path traversal.NuGet · sharpcompress · fixed in 0.29
- CVE-2021-23440Prototype PollutionNuGet · set-value-nuget · fixed in 2.0.0
- CVE-2021-23427Arbitrary File Write via Archive Extraction (Zip Slip)NuGet · elfinder.netcore
- CVE-2021-23428Directory TraversalNuGet · elfinder.netcore
- CVE-2021-34532ASP.NET Core and Visual Studio Information Disclosure VulnerabilityNuGet · microsoft.aspnetcore.authentication.jwtbearer · fixed in 2.1.29, 3.1.18, 5.0.9
- CVE-2021-34485.NET Core and Visual Studio Information Disclosure VulnerabilityNuGet · microsoft.netcore.app, microsoft.netcore.app.runtime.linux-arm +22 · fixed in 2.1.29, 3.1.18, 5.0.9
- CVE-2021-26423.NET Core and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +21 · fixed in 3.1.18, 5.0.9
- CVE-2021-23415Directory TraversalNuGet · elfinder.aspnet · fixed in 1.1.1
- CVE-2021-23407Directory TraversalNuGet · elfinder.net.core · fixed in 1.2.4
- CVE-2021-27293RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when convertinNuGet · restsharp · fixed in 106.11.8-alpha.0.13
- CVE-2020-15522Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue wiNuGet · bouncycastle · fixed in 1.8.7
- CVE-2021-20331MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an applicationNuGet · mongodb.driver · fixed in 2.12.2