Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-30349JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2020-36070Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php fiPackagist · tcg/voyager
- CVE-2023-27848broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.npm · broccoli-compass
- CVE-2023-30533SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file.npm · xlsx
- CVE-2022-48150Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.Packagist · shopware/shopware
- CVE-2023-29924PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.Maven · tech.powerjob:powerjob
- CVE-2022-4942mportuga eslint-detailed-reporter template-generator.js renderIssue cross site scriptingnpm · eslint-detailed-reporter
- CVE-2023-29926PowerJob V4.3.2 has unauthorized interface that causes remote code execution.Maven · tech.powerjob:powerjob
- CVE-2023-29921PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.Maven · tech.powerjob:powerjob
- CVE-2023-29922PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.Maven · tech.powerjob:powerjob
- CVE-2023-29923PowerJob V4.3.1 is vulnerable to Insecure Permissions.Maven · tech.powerjob:powerjob
- CVE-2023-30771Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchPyPI · apache-iotdb
- CVE-2023-2102Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointmentsPackagist · alextselegidis/easyappointments
- CVE-2023-2103Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointmentsPackagist · alextselegidis/easyappointments
- CVE-2023-2104Improper Access Control in alextselegidis/easyappointmentsPackagist · alextselegidis/easyappointments
- CVE-2023-2105Session Fixation in alextselegidis/easyappointmentsPackagist · alextselegidis/easyappointments
- CVE-2023-30532A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobMaven · org.jenkinsci.plugins.spoonscript:spoonscript
- CVE-2023-30531Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasinMaven · org.jenkins-ci.plugins:consul-kv-builder
- CVE-2023-30530Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on thMaven · org.jenkins-ci.plugins:consul-kv-builder
- CVE-2023-30528Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potentMaven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-30527Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins contrMaven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2023-30526A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an atMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30525A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attackerMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30524Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the poMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30523Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controllerMaven · org.jenkins-ci.plugins:reportportal
- CVE-2023-30522A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobsMaven · org.jenkins-ci.plugins:fogbugz
- CVE-2023-30521A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger bMaven · org.jenkins-ci.plugins:assembla-merge-request-builder
- CVE-2023-30520Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhookMaven · org.jenkins-ci.plugins:quayio-trigger
- CVE-2023-30519A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corrMaven · org.jenkins-ci.plugins:quayio-trigger
- CVE-2023-30518A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumeMaven · io.jenkins.plugins:thycotic-secret-server