Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-27212Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulMaven · org.jenkins-ci.plugins:list-git-branches-parameter
- CVE-2022-27211A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27210A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to conneMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27209A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27208Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on theMaven · org.jenkins-ci.plugins:kubernetes-cd
- CVE-2022-27207Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' pagMaven · org.jenkins-ci.plugins:global-build-stats
- CVE-2022-27205A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read perMaven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-27203Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from Maven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-27202Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parametMaven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-27198A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackersMaven · org.jenkins-ci.plugins:aws-credentials
- CVE-2022-0968The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweberPackagist · microweber/microweber
- CVE-2022-0961The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweberPackagist · microweber/microweber
- CVE-2022-25512FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.PyPI · freetakserver-ui
- CVE-2022-25511An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywPyPI · freetakserver-ui
- CVE-2022-25506FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.PyPI · freetakserver-ui
- CVE-2022-25507FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.PyPI · freetakserver-ui
- CVE-2021-44673A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a wPackagist · croogo/croogo
- CVE-2021-46703In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxNuGet · razorengine
- CVE-2020-18325Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.Packagist · intelliants/subrion
- CVE-2020-18324Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.Packagist · intelliants/subrion
- CVE-2020-18326Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which couldPackagist · intelliants/subrion
- CVE-2022-23328A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account Go · github.com/ethereum/go-ethereum
- CVE-2022-23327A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in onGo · github.com/ethereum/go-ethereum
- CVE-2022-23898MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.Maven · net.mingsoft:ms-mcms
- CVE-2022-23899MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.Maven · net.mingsoft:ms-mcms
- CVE-2022-24563In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_Packagist · genix/cms
- CVE-2022-23395jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).NuGet · jquery.cookie
- CVE-2022-26332Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.Packagist · andreapollastri/cipi
- CVE-2022-26149MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, becauPackagist · modx/revolution
- CVE-2021-37504A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary npm · jquery-file-upload