Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-45390A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentiMaven · io.loader:loaderio-jenkins-plugin
- CVE-2022-45393A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.Maven · org.jenkins-ci.plugins:delete-log-plugin
- CVE-2022-45394A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.Maven · org.jenkins-ci.plugins:delete-log-plugin
- CVE-2022-45395Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.thalesgroup.jenkins-ci.plugins:cccc
- CVE-2022-45396Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.thalesgroup.hudson.plugins:sourcemonitor
- CVE-2022-45397Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attMaven · org.jenkins-ci:update-center2
- CVE-2022-45398A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recordedMaven · org.zeroturnaround:cluster-stats
- CVE-2022-45399A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster StatisMaven · org.zeroturnaround:cluster-stats
- CVE-2022-45400Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jvnet.hudson.plugins:japex
- CVE-2022-45401Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSSMaven · org.jenkins-ci.main:associated-files-plugin
- CVE-2022-45136Apache Jena SDB allows arbitrary deserialisation via JDBCMaven · org.apache.jena:jena-sdb
- CVE-2022-45378Apache SOAP allows unauthenticated users to potentially invoke arbitrary codeMaven · soap:soap
- CVE-2021-40289mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS).Go · github.com/phachon/mm-wiki
- CVE-2022-36022Some Deeplearning4J packages use unclaimed s3 bucket in tests and examplesMaven · org.deeplearning4j:dl4j-examples, org.deeplearning4j:platform-tests
- CVE-2022-43120A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute Packagist · intelliants/subrion
- CVE-2022-43121A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitraryPackagist · intelliants/subrion
- CVE-2022-43320FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?Packagist · feehi/cms
- CVE-2022-44244An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.PyPI · lin-cms
- CVE-2022-3023Use of Externally-Controlled Format String in pingcap/tidbGo · github.com/pingcap/tidb
- CVE-2021-37823OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.Packagist · opencart/opencart
- CVE-2022-41710Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicionpm · electron-markdownify
- CVE-2022-41714fastest-json-copy 1.0.1 - Prototype Pollutionnpm · fastest-json-copy
- CVE-2022-42743deep-parse-json 1.0.2 - Prototype Pollutionnpm · deep-parse-json
- CVE-2022-37620A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expressionnpm · html-minifier
- CVE-2022-3771easyii CMS File Upload Management Upload.php file unrestricted uploadPackagist · noumo/easyii
- CVE-2022-40487ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages funPackagist · processwire/processwire
- CVE-2022-40488ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).Packagist · processwire/processwire
- CVE-2022-43281wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() PyPI · wabt
- CVE-2022-36182Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to maliGo · github.com/hashicorp/boundary
- CVE-2022-25849Cross-site Scripting (XSS)Packagist · joyqi/hyper-down