Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-34252wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupiPyPI · pywasm3
- CVE-2024-34483OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0.PyPI · ryu
- CVE-2024-34484OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0.PyPI · ryu
- CVE-2024-34486OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0.PyPI · ryu
- CVE-2024-34487OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0.PyPI · ryu
- CVE-2024-34488OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0.PyPI · ryu
- CVE-2024-34489OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.PyPI · ryu
- CVE-2024-33398There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to imGo · github.com/piraeusdatastore/piraeus-operator, github.com/piraeusdatastore/piraeus-operator/v2
- CVE-2024-34449Vditor 3.10.3 allows XSS via an attribute of an A element.npm · vditor
- CVE-2024-34394libxmljs2 namespaces type confusion RCEnpm · libxmljs2
- CVE-2024-34393libxmljs2 attrs type confusion RCEnpm · libxmljs2
- CVE-2024-34392libxmljs namespaces type confusion RCEnpm · libxmljs
- CVE-2024-34391libxmljs attrs type confusion RCEnpm · libxmljs
- CVE-2024-4029Wildfly: no timeout for eap management interface may lead to denial of service (dos)Maven · org.wildfly:wildfly-domain-http
- CVE-2024-34148Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is Maven · org.jenkins-ci.plugins:partial-release-manager
- CVE-2024-34147Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins contMaven · org.jenkins-ci.plugins:telegrambot
- CVE-2024-32359An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtaiGo · github.com/carina-io/carina
- CVE-2024-33394An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token comGo · kubevirt.io/kubevirt
- CVE-2024-33396An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token…Go · github.com/karmada-io/karmada
- CVE-2024-25355s3-url-parser 1.0.3 is vulnerable to Denial of service via the regexes component.npm · s3-url-parser
- CVE-2024-33763lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.PyPI · lunasvg
- CVE-2024-33764lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.PyPI · lunasvg
- CVE-2024-33766lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.PyPI · lunasvg
- CVE-2024-33767lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.PyPI · lunasvg
- CVE-2024-33768lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.PyPI · lunasvg
- CVE-2023-46960Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp modPyPI · pypxe
- CVE-2024-32883MCUboot Injection attack of unprotected TLV valuesGo · github.com/mcu-tools/mcuboot
- CVE-2024-32880pyLoad allows upload to arbitrary folder lead to RCEPyPI · pyload-ng
- CVE-2024-31828Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via Packagist · lavalite/cms
- CVE-2024-1139Cluster-monitoring-operator: credentials leakGo · github.com/openshift/cluster-monitoring-operator