Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-38877A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023).Packagist · gugoan/economizzer
- CVE-2023-43884A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrPackagist · intelliants/subrion
- CVE-2023-43828A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML vPackagist · intelliants/subrion
- CVE-2023-43830A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scPackagist · intelliants/subrion
- CVE-2023-1633Insecure barbican configuration file leaking credentialPyPI · barbican
- CVE-2023-1636Incomplete container isolationPyPI · barbican
- CVE-2023-31716FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.lognpm · @frangoteam/fuxa
- CVE-2023-31717A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.npm · fuxa-server
- CVE-2023-31718FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.npm · fuxa-server
- CVE-2023-31719FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.npm · fuxa-server
- CVE-2022-1438Keycloak: xss on impersonation under specific circumstancesMaven · org.keycloak:keycloak-services
- CVE-2023-42399Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via tnpm · jodit
- CVE-2023-33831A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands npm · @frangoteam/fuxa
- CVE-2023-41626Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.PyPI · gradio
- CVE-2023-41369External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)PyPI · hana-ml
- CVE-2023-41564An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uplPackagist · cockpit-hq/cockpit
- CVE-2023-41578Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-42268Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-42276hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.Maven · cn.hutool:hutool-core, cn.hutool:hutool-json
- CVE-2023-42277hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.Maven · cn.hutool:hutool-core, cn.hutool:hutool-json
- CVE-2023-36387Apache Superset: Improper API permission for low privilege usersPyPI · apache-superset
- CVE-2023-41947A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to FrugMaven · io.jenkins.plugins:frugal-testing
- CVE-2023-41946A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal TesMaven · io.jenkins.plugins:frugal-testing
- CVE-2023-41945Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permiMaven · org.jenkins-ci.plugins:assembla-auth
- CVE-2023-41944Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41943Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with OvMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41942A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the Maven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41941A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-41940Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitMaven · org.tap4j:tap
- CVE-2023-41938A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules.Maven · org.jenkins-ci.plugins:ivy