Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-28684Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.sap.jenkinsci:remote-jobs-view-plugin
- CVE-2023-28683Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:phabricator-plugin
- CVE-2023-28682Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:perfpublisher
- CVE-2023-28681Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:vs-code-metrics
- CVE-2023-28680Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:crap4j
- CVE-2023-28679Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custoMaven · javagh.jenkins:mashup-portlets-plugin
- CVE-2023-28678Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resultMaven · org.jenkins-ci.plugins:cppcheck
- CVE-2023-28677Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build SMaven · org.jenkins-ci.plugins:convert-to-pipeline
- CVE-2023-28676A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a PipelinMaven · org.jenkins-ci.plugins:convert-to-pipeline
- CVE-2022-3101A flaw was found in tripleo-ansible.PyPI · tripleo-ansible
- CVE-2022-3146A flaw was found in tripleo-ansible.PyPI · tripleo-ansible
- CVE-2023-24788NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivePackagist · notrinos/notrinos-erp
- CVE-2023-27094An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management moMaven · cn.hippo4j:hippo4j-all
- CVE-2023-28431Frontier's modexp precompile is slow for even moduluscrates.io · pallet-evm-precompile-modexp
- CVE-2022-45003Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.Go · github.com/gophish/gophish
- CVE-2022-45004Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.Go · github.com/gophish/gophish
- CVE-2023-28685Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:absint-a3
- CVE-2023-27087Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageLMaven · com.xuxueli:xxl-job
- CVE-2023-1454jeecg-boot qurestSql sql injectionMaven · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-28109Play With Docker vulnerable to Authorization Bypass Through User-Controlled KeyGo · github.com/play-with-docker/play-with-docker
- CVE-2023-27095Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UsMaven · cn.hippo4j:hippo4j-core
- CVE-2023-26484On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specsGo · kubevirt.io/kubevirt
- CVE-2023-25345Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the includenpm · swig, swig-templates
- CVE-2023-25617OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)PyPI · sap-ai-sdk-base
- CVE-2023-24279A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbiMaven · org.onosproject:onos-archetypes
- CVE-2021-33360An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_pronpm · @stoqey/gnuplot
- CVE-2023-24774Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.Packagist · funadmin/funadmin
- CVE-2023-27115WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.PyPI · wabt
- CVE-2023-27117WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.PyPI · wabt
- CVE-2023-27119WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.PyPI · wabt