Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-28156Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directMaven · com.surenpi.jenkins:phoenix-autotest
- CVE-2022-28155Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.surenpi.jenkins:phoenix-autotest
- CVE-2022-28154Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attMaven · org.jenkins-ci.plugins:covcomplplot
- CVE-2022-28153Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting Maven · org.jvnet.hudson.plugins:sitemonitor
- CVE-2022-28152A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore thMaven · com.synopsys.jenkinsci:ownership
- CVE-2022-28151A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change Maven · com.synopsys.jenkinsci:ownership
- CVE-2022-28150A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change theMaven · com.synopsys.jenkinsci:ownership
- CVE-2022-28149Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-siteMaven · com.synopsys.jenkinsci:ownership
- CVE-2022-26980Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.Packagist · nilsteampassnet/teampass
- CVE-2021-46433In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary Packagist · fenom/fenom
- CVE-2022-26245Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.Go · github.com/open-falcon/falcon-plus
- CVE-2022-25576Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php.Packagist · anchorcms/anchor-cms
- CVE-2022-27820OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.Maven · org.zaproxy:zap
- CVE-2022-25481ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.Packagist · topthink/framework
- CVE-2022-26265Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.Packagist · contao/managed-edition
- CVE-2021-44908SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().npm · sails
- CVE-2022-0748Arbitrary Code Executionnpm · post-loader
- CVE-2021-23771Sandbox Bypassnpm · argencoders-notevil, notevil
- CVE-2022-25760Arbitrary Code Injectionnpm · accesslog
- CVE-2021-23632Remote Code Execution (RCE)npm · git
- CVE-2022-25296Prototype Pollutionnpm · bodymen
- CVE-2022-0749Deserialization of Untrusted DataNuGet · singoocms.utility
- CVE-2021-42219Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amGo · github.com/ethereum/go-ethereum
- CVE-2021-45851A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the servnpm · @frangoteam/fuxa
- CVE-2022-27218Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller whereMaven · com.incapptic.plugins:incapptic-connect-uploader
- CVE-2022-27217Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller wheMaven · com.vmware.vcac:vmware-vrealize-codestream
- CVE-2022-27216Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins contrMaven · org.jenkins-ci.plugins:dbcharts
- CVE-2022-27215A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to anMaven · org.jenkins-ci.plugins:release-helper
- CVE-2022-27214A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacMaven · org.jenkins-ci.plugins:release-helper
- CVE-2022-27213Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values iMaven · io.jenkins.plugins:environment-dashboard