Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-24440Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins cMaven · org.jenkins-ci.plugins:jira-steps
- CVE-2023-24442Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar pMaven · org.jenkins-ci.plugins:github-pr-coverage-status
- CVE-2023-24444Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.plugins:openid
- CVE-2023-24445Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.Maven · org.jenkins-ci.plugins:openid
- CVE-2023-24446A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in tMaven · org.jenkins-ci.plugins:openid
- CVE-2023-24447A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attaMaven · org.jenkins-ci.plugins:rabbitmq-consumer
- CVE-2023-24448A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to aMaven · org.jenkins-ci.plugins:rabbitmq-consumer
- CVE-2023-24449Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing Maven · org.jvnet.hudson.plugins:pwauth
- CVE-2023-24450Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be Maven · org.jenkins-ci.plugins:view-cloner
- CVE-2023-24451A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumeraMaven · org.jenkins-ci.plugins:cisco-spark-notifier-plugin
- CVE-2023-24452A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an atMaven · org.jenkins-ci.plugins:testquality-updater
- CVE-2023-24453A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attackeMaven · org.jenkins-ci.plugins:testquality-updater
- CVE-2023-24454Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on tMaven · org.jenkins-ci.plugins:testquality-updater
- CVE-2023-24455Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackersMaven · io.jenkins.plugins:visualexpert
- CVE-2023-24458A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-sMaven · org.jenkins-ci.plugins:bearychat
- CVE-2023-24459A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:bearychat
- CVE-2020-23256An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.npm · electerm
- CVE-2022-47747kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.Go · github.com/uber/kraken
- CVE-2022-47105Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.Maven · org.jeecgframework.boot:jeecg-boot-base-core, org.jeecgframework.boot:jeecg-module-system
- CVE-2023-22480KubeOperator is vulnerable to unauthorized access to system APIGo · github.com/kubeoperator/kubeoperator
- CVE-2022-25890All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.npm · wifey
- CVE-2022-45935Apache James server: Temporary File Information DisclosureMaven · org.apache.james:james-server
- CVE-2021-32828Regular expression Denial of Service in MooToolsMaven · org.nuxeo.ecm.platform:nuxeo-platform-oauth
- CVE-2021-32821Regular expression Denial of Service in MooToolsnpm · mootools
- CVE-2017-20151iText RUPS XfaFile.java xml external entity referenceMaven · com.itextpdf:itext-rups
- CVE-2022-4844Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos
- CVE-2022-4846Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos
- CVE-2022-4850Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos
- CVE-2022-4772Widoco WidocoUtils.java unZipIt path traversalMaven · com.github.dgarijo:widoco
- CVE-2022-3347Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolverGo · github.com/peterzen/goresolver