Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-47620Scrypted reflected Cross-site Scripting vulnerabilitynpm · @scrypted/server
- CVE-2023-47623Scrypted reflected Cross-site Scripting vulnerabilitynpm · @scrypted/core
- CVE-2023-50779Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to aMaven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50778A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an atMaven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50777Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, incMaven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50776Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins Maven · com.cloudtp.jenkins:paaslane-estimate
- CVE-2023-50775A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.Maven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2023-50774A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary filesMaven · org.jenkins-ci.plugins:htmlresource
- CVE-2023-50773Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the poteMaven · com.zintow:dingding-json-pusher
- CVE-2023-50772Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller whereMaven · com.zintow:dingding-json-pusher
- CVE-2023-50765A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read Maven · org.jenkins-ci.plugins:scriptler
- CVE-2023-50764Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackerMaven · org.jenkins-ci.plugins:scriptler
- CVE-2013-2513The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file.RubyGems · flash_tool
- CVE-2015-2179The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.RubyGems · xaviershay-dm-rails
- CVE-2023-6654PHPEMS Session Data session.cls.php deserializationPackagist · phpems/phpems
- CVE-2023-50449JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.Maven · com.jfinal:jfinal
- CVE-2023-50463The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof theiGo · github.com/shift72/caddy-geo-ip
- CVE-2023-26158All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute npm · mockjs
- CVE-2023-49485JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.Maven · com.jfinal:jfinal
- CVE-2023-49486JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.Maven · com.jfinal:jfinal
- CVE-2023-49487JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.Maven · com.jfinal:jfinal
- CVE-2023-47440Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal.npm · gladys
- CVE-2023-49372JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.Maven · com.jfinal:jfinal
- CVE-2023-49373JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.Maven · com.jfinal:jfinal
- CVE-2023-49374JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.Maven · com.jfinal:jfinal
- CVE-2023-49375JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.Maven · com.jfinal:jfinal
- CVE-2023-49376JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.Maven · com.jfinal:jfinal
- CVE-2023-49377JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.Maven · com.jfinal:jfinal
- CVE-2023-49378JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.Maven · com.jfinal:jfinal
- CVE-2023-49379JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.Maven · com.jfinal:jfinal