Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-39619ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.npm · node-email-check
- CVE-2023-44769A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted scriptPackagist · tribalsystems/zenario
- CVE-2023-44760Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted scriptPackagist · concrete5/concrete5
- CVE-2023-46331WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.PyPI · wabt
- CVE-2023-46332WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.PyPI · wabt
- CVE-2023-46277please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl.crates.io · pleaser
- CVE-2023-43340Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injectPackagist · evolutioncms/evolution
- CVE-2023-43341Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload inPackagist · evolutioncms/evolution
- CVE-2023-43875Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web Packagist · intelliants/subrion
- CVE-2023-44690Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.pyPyPI · mycli
- CVE-2023-45146Remote code execution in XXL-RPCMaven · com.xuxueli:xxl-rpc-core
- CVE-2023-42319Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumptiGo · github.com/ethereum/go-ethereum
- CVE-2023-4822Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana
- CVE-2023-26155All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize npm · node-qpdf
- CVE-2023-45853MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,PyPI · pyminizip
- CVE-2023-44763Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSPackagist · concrete5/concrete5
- CVE-2023-44762A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a cPackagist · concrete5/concrete5
- CVE-2023-44764A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of InstaPackagist · concrete5/concrete5
- CVE-2023-44766A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the Packagist · concrete5/concrete5
- CVE-2023-44770A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to tPackagist · tribalsystems/zenario
- CVE-2023-44771A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted scriptPackagist · tribalsystems/zenario
- CVE-2023-45282In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.npm · openmct
- CVE-2023-4237Platform: ec2_key module prints out the private key directly to the standard outputPyPI · ansible-core
- CVE-2023-26152All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath npm · static-server
- CVE-2023-5318Use of Hard-coded Credentials in microweber/microweberPackagist · microweber/microweber
- CVE-2023-5244Cross-site Scripting (XSS) - Reflected in microweber/microweberPackagist · microweber/microweber
- CVE-2023-38871The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password Packagist · gugoan/economizzer
- CVE-2023-38872An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthPackagist · gugoan/economizzer
- CVE-2023-38873The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking.Packagist · gugoan/economizzer
- CVE-2023-38874A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (AprilPackagist · gugoan/economizzer