Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23760Prototype Pollutionnpm · keyget
- CVE-2021-46385https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection.Maven · net.mingsoft:ms-mcms
- CVE-2021-46386File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to nMaven · net.mingsoft:ms-mcms
- CVE-2021-46089In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.Maven · org.jeecgframework.boot:jeecg-boot-base, org.jeecgframework.boot:jeecg-boot-base-core
- CVE-2022-0269Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrmPackagist · yetiforce/yetiforce-crm
- CVE-2021-39480Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).crates.io · bingrep
- CVE-2021-23631Directory Traversalnpm · convert-svg-core, convert-svg-to-jpeg +1
- CVE-2022-23315MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.Maven · net.mingsoft:ms-mcms
- CVE-2022-22929MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbiMaven · net.mingsoft:ms-mcms
- CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.Maven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2022-23305SQL injection in JDBC Appender in Apache Log4j V1Maven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2022-23302Deserialization of untrusted data in JMSSink in Apache Log4j 1.xMaven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2022-0245Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchatPackagist · livehelperchat/livehelperchat
- CVE-2021-3862Cross-site Scripting (XSS) - Reflected in icecoder/icecoderPackagist · icecoder/icecoder
- CVE-2022-0253Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatPackagist · remdex/livehelperchat
- CVE-2021-23567Denial of Service (DoS)npm · colors
- CVE-2022-0224SQL Injection in dolibarr/dolibarrPackagist · dolibarr/dolibarr
- CVE-2022-21685Integer underflow in Frontiercrates.io · pallet-evm-precompile-modexp
- CVE-2022-0198Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpMaven · edu.stanford.nlp:stanford-corenlp
- CVE-2022-23118Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attaMaven · ru.yandex.jenkins.plugins.debuilder:debian-package-builder
- CVE-2022-23115Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access toMaven · org.jenkins-ci.plugins:batch-task
- CVE-2021-23543Sandbox Bypassnpm · realms-shim
- CVE-2021-23594Sandbox Bypassnpm · realms-shim
- CVE-2020-27428A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTMnpm · scratch-svg-renderer
- CVE-2020-36511An issue was discovered in the bite crate through 2020-12-31 for Rust.crates.io · bite
- CVE-2020-36512An issue was discovered in the buffoon crate through 2020-12-31 for Rust.crates.io · buffoon
- CVE-2020-36513An issue was discovered in the acc_reader crate through 2020-12-27 for Rust.crates.io · acc_reader
- CVE-2020-36514An issue was discovered in the acc_reader crate through 2020-12-27 for Rust.crates.io · acc_reader
- CVE-2021-45682An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust.crates.io · bronzedb-protocol
- CVE-2021-45683An issue was discovered in the binjs_io crate through 2021-01-03 for Rust.crates.io · binjs_io