Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-0914Improper Authorization in pixelfed/pixelfedPackagist · pixelfed/pixelfed
- CVE-2023-0901Exposure of Sensitive Information to an Unauthorized Actor in pixelfed/pixelfedPackagist · pixelfed/pixelfed
- CVE-2022-38867SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbitrary code.Go · github.com/zhaojh329/rttys
- CVE-2023-24187An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to Maven · com.bstek.ureport:ureport2-core
- CVE-2023-24188ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to bMaven · com.bstek.ureport:ureport2-core
- CVE-2022-45982thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability.Packagist · topthink/think
- CVE-2022-25853All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitizanpm · semver-tags
- CVE-2022-25855All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input saninpm · create-choo-app3
- CVE-2023-0674XXL-JOB New Password updatePwd cross-site request forgeryMaven · com.xuxueli:xxl-job
- CVE-2021-37304An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive infMaven · org.jeecgframework.boot:jeecg-boot-base
- CVE-2021-37305An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive informaMaven · org.jeecgframework.boot:jeecg-boot-base
- CVE-2021-37306An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive informaMaven · org.jeecgframework.boot:jeecg-boot-base
- CVE-2023-24997Apache InLong: Jdbc Connection Security BypassMaven · org.apache.inlong:inlong
- CVE-2023-24977Apache InLong: Jdbc Connection causes arbitrary file reading in InLongMaven · org.apache.inlong:inlong
- CVE-2022-25906All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes benpm · is-http2
- CVE-2023-24162Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameteMaven · cn.hutool:hutool-all
- CVE-2021-36686Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.npm · yapi-vendor
- CVE-2022-25962All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.npm · vagrant.js
- CVE-2022-21810All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.npm · smartctl
- CVE-2022-25894All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jeMaven · com.bstek.uflo:uflo-core
- CVE-2022-21192All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protectionpm · serve-lite
- CVE-2022-25847All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it rennpm · serve-lite
- CVE-2022-25908All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-inputnpm · create-choo-electron
- CVE-2022-25350All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.npm · puppet-facter
- CVE-2023-24426Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:azure-ad
- CVE-2023-24434A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to conneMaven · org.jenkins-ci.plugins:ghprb
- CVE-2023-24435A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:ghprb
- CVE-2023-24436A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission toMaven · org.jenkins-ci.plugins:ghprb
- CVE-2023-24437A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers tMaven · org.jenkins-ci.plugins:jira-steps
- CVE-2023-24438A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permisMaven · org.jenkins-ci.plugins:jira-steps