Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-50172A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master coPackagist · wwbn/avideo
- CVE-2023-49810A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.Packagist · wwbn/avideo
- CVE-2023-49599An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb.Packagist · wwbn/avideo
- CVE-2023-46906juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code.Packagist · juzaweb/cms
- CVE-2023-51441Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP APIMaven · axis:axis, org.apache.axis:axis
- CVE-2023-6551Stored XSS in class.upload.phpPackagist · verot/class.upload.php
- CVE-2023-39655A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0.npm · @perfood/couch-auth
- CVE-2020-26623SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the AreaPackagist · gilacms/gila
- CVE-2020-26624A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts Packagist · gilacms/gila
- CVE-2020-26625A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts Packagist · gilacms/gila
- CVE-2023-41542SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information viaMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-41543SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the coMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-41544SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the Maven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-50578Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.Maven · net.mingsoft:ms-mcms
- CVE-2023-7152MicroPython modselect.c poll_set_add_fd use after freePyPI · micropython-copy, micropython-io +2
- CVE-2023-7148ShifuML shifu Java Expression Language DataPurifier.java code injectionMaven · ml.shifu:shifu
- CVE-2023-50571easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.Maven · org.jeasy:easy-rules-mvel
- CVE-2023-51079A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups.Maven · org.mvel:mvel2
- CVE-2023-51084hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.Maven · com.github:hyavijava
- CVE-2023-27150openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Maven · org.opencrx:opencrx-core
- CVE-2023-49391An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AGo · github.com/free5gc/amf
- CVE-2023-7037automad FileController.php import server-side request forgeryPackagist · automad/automad
- CVE-2023-50475An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithmnpm · bsock
- CVE-2023-50481An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms npm · blinksocks
- CVE-2023-6886xnx3 wangmarket Role Management Page code injectionMaven · com.xnx3.wangmarket:wangmarket
- CVE-2023-6835Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating couldMaven · org.wso2.carbon.apimgt:forum
- CVE-2023-50100JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.Maven · com.jfinal:jfinal
- CVE-2023-50101JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.Maven · com.jfinal:jfinal
- CVE-2023-50102JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).Maven · com.jfinal:jfinal
- CVE-2023-50137JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.Maven · com.jfinal:jfinal