Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-34660jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-3276Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referenceMaven · cn.hutool:hutool-core
- CVE-2023-35149A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permissiMaven · org.jenkins-ci.plugins:ease-plugin
- CVE-2023-35148A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to Maven · org.jenkins-ci.plugins:ease-plugin
- CVE-2023-35147Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowiMaven · org.jenkins-ci.plugins:aws-codecommit-trigger
- CVE-2023-35146Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template WorkfloMaven · org.jenkins.plugin.templateworkflows:template-workflows
- CVE-2023-35145Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validMaven · org.jenkins-ci.plugins:sonargraph-integration
- CVE-2023-35144Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven RepoMaven · jenkins:repository
- CVE-2023-35143Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven RepoMaven · jenkins:repository
- CVE-2023-34612An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object thaMaven · com.helger.commons:ph-json
- CVE-2023-34613An issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uMaven · net.sf.sojo:sojo
- CVE-2023-34614An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted obMaven · cc.plural:jsonij
- CVE-2023-34615An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatMaven · net.pwall.json:jsonutil
- CVE-2023-34616An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatMaven · com.progsbase.libraries:json
- CVE-2023-34617An issue was discovered genson thru 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uMaven · com.owlike:genson
- CVE-2023-35110An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that Maven · de.grobmeier.json:jjson
- CVE-2023-33290The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in libcrates.io · git-url-parse
- CVE-2023-3163y_project RuoYi filterKeyword resource consumptionMaven · com.ruoyi:ruoyi
- CVE-2023-3142Cross-site Scripting (XSS) - Stored in microweber/microweberPackagist · microweber/microweber
- CVE-2023-33496xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NeMaven · com.xuxueli:xxl-rpc-core
- CVE-2023-33498alist <=3.16.3 is vulnerable to Incorrect Access Control.Go · github.com/alist-org/alist/v3
- CVE-2023-33510Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.Maven · org.jeecgframework.p3:jeecg-p3-biz-chat
- CVE-2023-33544hawtio 2.17.2 is vulnerable to Path Traversal.Maven · io.hawt:project
- CVE-2023-33546Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method.Maven · org.codehaus.janino:janino-parent
- CVE-2023-26131All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerablGo · github.com/xyproto/algernon
- CVE-2023-33736A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a Packagist · dcat/laravel-admin
- CVE-2023-2970MindSpore json_helper.cc UpdateArray memory corruptionPyPI · mindspore
- CVE-2023-32691ginuerzh/gost vulnerable to Timing AttackGo · github.com/ginuerzh/gost
- CVE-2023-26127All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function.npm · n158
- CVE-2023-26128All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sannpm · keep-module-latest