Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-40743Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceMaven · axis:axis, org.apache.axis:axis
- CVE-2023-36307ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image oGo · simonwaldherr.de/go/zplgfa
- CVE-2023-36308disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafGo · github.com/disintegration/imaging
- CVE-2023-4698Improper Input Validation in usememos/memosGo · github.com/usememos/memos
- CVE-2023-40771SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of thMaven · io.dataease:dataease-plugin-common
- CVE-2023-38970Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload tPackagist · uasoft-indonesia/badaso
- CVE-2023-39663Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the componnpm · mathjax
- CVE-2023-40787In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL Maven · org.springblade:blade-core-tool
- CVE-2023-40889A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90.PyPI · zbar
- CVE-2023-39348Improper log output when using GitHub Status Notifications in spinnakerGo · github.com/spinnaker/spinnaker
- CVE-2023-39059An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables paramGo · github.com/ansible-semaphore/semaphore
- CVE-2023-40826An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zipplugMaven · org.pf4j:pf4j
- CVE-2023-40827An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluMaven · org.pf4j:pf4j
- CVE-2023-40828An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIMaven · org.pf4j:pf4j
- CVE-2023-41005An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UPackagist · pagekit/pagekit
- CVE-2023-24620An issue was discovered in Esoteric YamlBeans through 1.15.Maven · com.esotericsoftware.yamlbeans:yamlbeans
- CVE-2023-24621An issue was discovered in Esoteric YamlBeans through 1.15.Maven · com.esotericsoftware.yamlbeans:yamlbeans
- CVE-2020-18831Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of servicePyPI · exiv2
- CVE-2023-39141webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.npm · webui-aria2
- CVE-2023-39106An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls ConstrMaven · com.alibaba.nacos:nacos-spring-context
- CVE-2023-4451Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitPackagist · cockpit-hq/cockpit
- CVE-2023-4433Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpitPackagist · cockpit-hq/cockpit
- CVE-2023-4432Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitPackagist · cockpit-hq/cockpit
- CVE-2023-4395Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpitPackagist · cockpit-hq/cockpit
- CVE-2023-36106An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the inteMaven · tech.powerjob:powerjob
- CVE-2023-38905SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_SleeMaven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-40351A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or reMaven · org.jenkins-ci.plugins:favorite-view
- CVE-2023-40350Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm DashboaMaven · org.jenkins-ci.plugins:docker-swarm
- CVE-2023-40349Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers tMaven · org.jenkins-ci.plugins:gogs-webhook
- CVE-2023-40348The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs inMaven · org.jenkins-ci.plugins:gogs-webhook