Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-49380JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.Maven · com.jfinal:jfinal
- CVE-2023-49381JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.Maven · com.jfinal:jfinal
- CVE-2023-49382JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.Maven · com.jfinal:jfinal
- CVE-2023-49383JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.Maven · com.jfinal:jfinal
- CVE-2023-49395JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.Maven · com.jfinal:jfinal
- CVE-2023-49396JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.Maven · com.jfinal:jfinal
- CVE-2023-49397JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.Maven · com.jfinal:jfinal
- CVE-2023-49398JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.Maven · com.jfinal:jfinal
- CVE-2023-49446JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.Maven · com.jfinal:jfinal
- CVE-2023-49447JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.Maven · com.jfinal:jfinal
- CVE-2023-49448JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.Maven · com.jfinal:jfinal
- CVE-2023-48966An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary cPackagist · zoujingli/thinkadmin
- CVE-2023-48967Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.Maven · org.noear:solon
- CVE-2023-48887A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.Maven · org.jupiter-rpc:jupiter-rpc
- CVE-2023-49371RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.Maven · com.ruoyi:ruoyi
- CVE-2023-49735Apache Tiles: Unvalidated input may lead to path traversal and XXEMaven · org.apache.struts:struts-tiles, org.apache.tiles:tiles-core +1
- CVE-2023-6027Cross-site Scripting vulnerability in PHPMemcachedAdminPackagist · elijaa/phpmemcacheadmin
- CVE-2023-6026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in PHPMemcachedAdminPackagist · elijaa/phpmemcacheadmin
- CVE-2023-49052File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload fPackagist · microweber/microweber
- CVE-2023-49092RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannelscrates.io · rsa
- CVE-2023-48022Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.PyPI · ray
- CVE-2023-48848An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a craftMaven · com.bstek.ureport:ureport2-core
- CVE-2023-46480An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter oGo · github.com/owncast/owncast
- CVE-2023-49210The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and anpm · openssl
- CVE-2023-47467Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file dirMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-48051An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.PyPI · upydev
- CVE-2023-40809OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40810OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40812OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40813OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.Maven · org.opencrx:opencrx-core-models