Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25098ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.Packagist · ectouch/ectouch
- CVE-2021-23702Prototype Pollutionnpm · object-extend
- CVE-2021-46063MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.Maven · net.mingsoft:ms-mcms
- CVE-2021-46037MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.Maven · net.mingsoft:ms-mcms
- CVE-2021-46036An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary codeMaven · net.mingsoft:ms-mcms
- CVE-2021-44868A problem was found in ming-soft MCMS v5.1.Maven · net.mingsoft:ms-mcms
- CVE-2022-22880Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.Maven · org.jeecgframework.boot:jeecg-boot-base, org.jeecgframework.boot:jeecg-boot-base-core
- CVE-2022-22881Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.Maven · org.jeecgframework.boot:jeecg-boot-base, org.jeecgframework.boot:jeecg-boot-base-core
- CVE-2022-25212A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-speciMaven · org.continuousassurance.swamp.jenkins:swamp
- CVE-2022-25211A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attackerMaven · org.continuousassurance.swamp.jenkins:swamp
- CVE-2022-25210Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers withMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-25209Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2022-25208A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins senMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2022-25207A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2022-25206A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifiMaven · org.jenkins-ci.plugins:dbcharts
- CVE-2022-25205A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-spMaven · org.jenkins-ci.plugins:dbcharts
- CVE-2022-25204Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown oMaven · by.dev.madhead.doktor:doktor
- CVE-2022-25203Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploMaven · com.sonymobile.jenkins.plugins.teamviews:team-views
- CVE-2022-25202Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-sitMaven · org.jenkins-ci.plugins:promoted-builds-simple
- CVE-2022-25199A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an atMaven · org.jenkins-ci.plugins:scp
- CVE-2022-25198A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attackerMaven · org.jenkins-ci.plugins:scp
- CVE-2022-25196Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authenticMaven · org.jenkins-ci.plugins:gitlab-oauth
- CVE-2022-25192A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attackMaven · io.jenkins.plugins:embotics-vcommander
- CVE-2021-44892A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtPackagist · topthink/framework
- CVE-2021-45919Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.Packagist · studio-42/elfinder
- CVE-2022-0504Generation of Error Message Containing Sensitive Information in microweber/microweberPackagist · microweber/microweber
- CVE-2022-0505Cross-Site Request Forgery (CSRF) in microweber/microweberPackagist · microweber/microweber
- CVE-2022-0506Cross-site Scripting (XSS) - Stored in microweber/microweberPackagist · microweber/microweber
- CVE-2020-8562Bypass of Kubernetes API Server proxy TOCTOUGo · k8s.io/kubernetes
- CVE-2021-44255Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration bPyPI · motioneye