Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-30517Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when coMaven · io.jenkins.plugins:neuvector-vulnerability-scanner
- CVE-2023-30516Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to DockeMaven · org.jenkins-ci.plugins:image-tag-parameter
- CVE-2023-30515Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the builMaven · io.jenkins.plugins:thycotic-devops-secrets-vault
- CVE-2023-30512CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation.Go · github.com/cubefs/cubefs
- CVE-2023-26122All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization.npm · safe-eval
- CVE-2023-26121All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its pnpm · safe-eval
- CVE-2023-1971yuan1994 tpAdmin Upload.php remote server-side request forgeryPackagist · yuan1994/tpadmin
- CVE-2023-1970yuan1994 tpAdmin Upload.php Upload unrestricted uploadPackagist · yuan1994/tpadmin
- CVE-2023-26120This affects all versions of the package com.xuxueli:xxl-job.Maven · com.xuxueli:xxl-job
- CVE-2020-19277Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code iGo · github.com/phachon/mm-wiki
- CVE-2020-19278Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/Go · github.com/phachon/mm-wiki
- CVE-2020-19697Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scriptnpm · editor.md
- CVE-2020-19698Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scriptnpm · editor.md
- CVE-2020-21514An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default passwRubyGems · fluentd-ui
- CVE-2021-28235Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.Go · go.etcd.io/etcd/v3
- CVE-2023-0265Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server.Packagist · uvdesk/community-skeleton
- CVE-2023-0325Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application.Packagist · uvdesk/community-skeleton
- CVE-2023-0835markdown-pdf 11.0.0 - Local File Read via Server Side XSSnpm · markdown-pdf
- CVE-2023-1784jeecg-boot API Documentation improper authenticationMaven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-27159Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon.Packagist · appwrite/server-ce
- CVE-2023-27162openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}.Maven · org.openapitools:openapi-generator-project
- CVE-2023-27163request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}.Go · github.com/darklynx/request-baskets
- CVE-2023-1741jeecg-boot Sleep Command SysDictMapper.java sql injectionMaven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-28935Apache UIMA DUCC: DUCC (EOL) allows RCEMaven · org.apache.uima:uima-ducc-parent
- CVE-2023-26116Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility funpm · angular
- CVE-2023-26118Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> elementnpm · angular
- CVE-2023-26117Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to tnpm · angular
- CVE-2023-1712Use of Hard-coded, Security-relevant Constants in deepset-ai/haystackPyPI · farm-haystack
- CVE-2023-22249Adobe Commerce Stored XSS Arbitrary code executionPackagist · magento/community-edition
- CVE-2023-27096Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyCoMaven · cn.hippo4j:hippo4j-all