Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-40373Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.Packagist · feehi/feehicms
- CVE-2022-45689hutool-json v5.8.10 was discovered to contain an out of memory error.Maven · cn.hutool:hutool-json
- CVE-2022-45970Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.Go · github.com/alist-org/alist/v3
- CVE-2022-34297Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.Packagist · yiisoft/yii2-gii
- CVE-2022-4123A flaw was found in Buildah.Go · github.com/containers/podman/v4
- CVE-2022-4348y_project RuoYi-Cloud JSON cross site scriptingMaven · com.ruoyi:ruoyi-common
- CVE-2022-4350Mingsoft MCMS search.do cross site scriptingMaven · net.mingsoft:ms-mcms
- CVE-2022-44289Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.Packagist · topthink/framework
- CVE-2022-4231Tribal Systems Zenario CMS Remember Me session fixiationPackagist · tribalsystems/zenario
- CVE-2022-25848Directory Traversalnpm · static-dev-server
- CVE-2022-45933KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authenticGo · github.com/benc-uk/kubeview
- CVE-2022-0698Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.Packagist · microweber/microweber
- CVE-2022-37721PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and jaPackagist · pyrocms/pyrocms
- CVE-2022-42095Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.Packagist · backdrop/backdrop
- CVE-2022-33012Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.Packagist · microweber/microweber
- CVE-2022-42094Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.Packagist · backdrop/backdrop
- CVE-2022-42097Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .Packagist · backdrop/backdrop
- CVE-2022-42096Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.Packagist · backdrop/backdrop
- CVE-2022-45470Apache Hama allows XSS and information disclosureMaven · org.apache.hama:hama-core
- CVE-2022-38871In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.Go · github.com/free5gc/free5gc
- CVE-2022-4014FeehiCMS Post My Comment Tab cross-site request forgeryPackagist · feehi/feehicms
- CVE-2022-44069Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.Packagist · tribalsystems/zenario
- CVE-2022-44070Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.Packagist · tribalsystems/zenario
- CVE-2022-44071Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.Packagist · tribalsystems/zenario
- CVE-2022-44073Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.Packagist · tribalsystems/zenario
- CVE-2022-38666Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validMaven · org.jenkins-ci.main:cavisson-ns-nd-integration
- CVE-2022-45386Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:violations
- CVE-2022-45387Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in aMaven · org.jenkins-ci.plugins:bart
- CVE-2022-45388Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated Maven · org.jenkins-ci.main:config-rotator
- CVE-2022-45389A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs correspondingMaven · com.cloudbees.jenkins.plugins:xpdev