Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-40814OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40815OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40816OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40817OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-46402git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.Go · github.com/whilp/git-urls
- CVE-2023-6038Local File Inclusion in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2023-47025An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.Go · github.com/free5gc/free5gc
- CVE-2023-48054Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a maPyPI · localstack
- CVE-2023-48056PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption.PyPI · pypinksign
- CVE-2023-5720Quarkus: build env information disclosure via gradle pluginMaven · io.quarkus:quarkus-project
- CVE-2023-47345Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP HeGo · github.com/free5gc/free5gc
- CVE-2023-48087xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.Maven · com.xuxueli:xxl-job-admin
- CVE-2023-48088xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.Maven · com.xuxueli:xxl-job-admin
- CVE-2023-48089xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.Maven · com.xuxueli:xxl-job-admin
- CVE-2023-5189Hub: insecure galaxy-importer tarfile extractionPyPI · galaxy-importer
- CVE-2023-47390Headscale through 0.22.3 writes bearer tokens to info-level logs.Go · github.com/juanfont/headscale
- CVE-2023-45885Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new comnpm · openmct
- CVE-2023-46894An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.PyPI · esptool
- CVE-2023-45875An issue was discovered in Couchbase Server 7.2.0.PyPI · couchbase
- CVE-2023-46998Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted npm · bootbox
- CVE-2023-44398Out-of-bounds write in exiv2PyPI · exiv2
- CVE-2023-46947Subrion 4.2.1 has a remote command execution vulnerability in the backend.Packagist · intelliants/subrion
- CVE-2023-46925Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).Packagist · reportico-web/reportico
- CVE-2023-43792baserCMS Code Injection Vulnerability in Mail Form FeaturePackagist · baserproject/basercms
- CVE-2023-46468An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.Packagist · juzaweb/cms
- CVE-2023-46660Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook tMaven · org.jenkins-ci.plugins:zanata
- CVE-2023-46659Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripMaven · org.jenkins-ci.plugins:trac
- CVE-2023-46658Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided andMaven · io.jenkins.plugins:teams-webhook-trigger
- CVE-2023-46657Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook Maven · org.jenkins-ci.plugins:gogs-webhook
- CVE-2023-46656Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the proMaven · igalg.jenkins.plugins:multibranch-scan-webhook-trigger