Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-26129All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwmnpm · bwm-ng
- CVE-2023-33779A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crMaven · com.xuxueli:xxl-job
- CVE-2023-2862SiteServer CMS search cross site scriptingNuGet · sscms
- CVE-2023-31826Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages.Maven · org.skyscreamer:nevado-jms
- CVE-2023-33252iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modunpm · snarkjs
- CVE-2023-30124LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).Packagist · lavalite/cms
- CVE-2023-33007Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (Maven · org.jenkins-ci.plugins:loadcomplete
- CVE-2023-33006A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging Maven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-33005Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-33004A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler stMaven · org.jenkins-ci.plugins:tag-profiler
- CVE-2023-33003A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistiMaven · org.jenkins-ci.plugins:tag-profiler
- CVE-2023-33002Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scriptMaven · org.jenkins-ci.plugins:testcomplete
- CVE-2023-33001Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the buildMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin
- CVE-2021-27131Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML SPackagist · moodle/moodle
- CVE-2023-31890An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() pMaven · com.glazedlists:glazedlists
- CVE-2022-47937Multiple parsing problems in the Apache Sling Commons JSON moduleMaven · org.apache.sling:org.apache.sling.commons.json
- CVE-2023-32758giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial ofPyPI · git-url-parse
- CVE-2023-32073AVideo command injection vulnerabilityPackagist · wwbn/avideo
- CVE-2023-27237LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.Packagist · lavalite/cms
- CVE-2023-27238LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.Packagist · lavalite/cms
- CVE-2023-30130An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.Packagist · craftcms/cms
- CVE-2023-26126All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested vinpm · m.static
- CVE-2020-22755File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.Maven · net.mingsoft:ms-mcms
- CVE-2023-30093A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbiMaven · org.onosproject:onos-archetypes
- CVE-2023-30331An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.Maven · com.ibeetl:beetl
- CVE-2023-25827Cross-site Scripting in OpenTSDBMaven · net.opentsdb:opentsdb
- CVE-2023-25826Remote Code Execution in OpenTSDBMaven · net.opentsdb:opentsdb
- CVE-2023-2479OS Command Injection in appium/appium-desktopnpm · appium-desktop
- CVE-2023-29918RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.Packagist · francoisjacquet/rosariosis
- CVE-2023-29641Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted npm · editor.md