Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-37964A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attackMaven · org.jenkins-ci.plugins:elasticbox
- CVE-2023-37963A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect Maven · io.jenkins.plugins:benchmark-evaluator
- CVE-2023-37962A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an Maven · io.jenkins.plugins:benchmark-evaluator
- CVE-2023-37961A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into loggMaven · org.jenkins-ci.plugins:assembla-auth
- CVE-2023-37960Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files froMaven · com.mathworks.polyspace.jenkins:mathworks-polyspace
- CVE-2023-37959A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect Maven · org.jenkins-ci.plugins:sumologic-publisher
- CVE-2023-37958A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an Maven · org.jenkins-ci.plugins:sumologic-publisher
- CVE-2023-37957A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an Maven · io.jenkins.plugins:pipeline-restful-api
- CVE-2023-37956A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to conMaven · org.jenkins-ci.plugins:test-results-aggregator
- CVE-2023-37954A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a Maven · com.sonyericsson.hudson.plugins.rebuild:rebuild
- CVE-2023-3566wallabag Profile Config config allocation of resourcesPackagist · wallabag/wallabag
- CVE-2023-37264Pipelines do not validate child UIDsGo · github.com/tektoncd/pipeline
- CVE-2023-34150Apache Any23: Possible excessive allocation of resources reading input.Maven · org.apache.any23:apache-any23
- CVE-2023-36815Sealos billing system permission control defectGo · github.com/labring/sealos
- CVE-2023-26135All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.npm · flatnest
- CVE-2023-34840angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.npm · angular-ui-notification
- CVE-2023-37302An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3.Packagist · wikibase/wikibase
- CVE-2020-26708requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitraPyPI · requests-xml
- CVE-2020-26709py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code PyPI · py-xml
- CVE-2020-26710easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary PyPI · easy-parse
- CVE-2021-31635Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template fMaven · com.jfinal:jfinal
- CVE-2023-35932jcvi vulnerable to Configuration Injection due to unsanitized user input PyPI · jcvi
- CVE-2023-34927Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password.Go · github.com/casdoor/casdoor
- CVE-2023-36097funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.Packagist · funadmin/funadmin
- CVE-2020-20697Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstiviePackagist · khodakhah/nodcms
- CVE-2020-20726Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/Packagist · gilacms/gila
- CVE-2020-21485Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browMaven · org.alluxio:alluxio-parent
- CVE-2023-33495Craft CMS through 4.4.9 is vulnerable to HTML Injection.Packagist · craftcms/cms
- CVE-2023-3308whaleal IceFrog Aviator Template Engine deserializationMaven · com.whaleal.icefrog:icefrog-all
- CVE-2023-34659jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.Maven · org.jeecgframework.boot:jeecg-boot-parent