Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-43677In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString.Go · github.com/free5gc/aper, github.com/free5gc/free5gc
- CVE-2022-37298Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control.PyPI · shinken
- CVE-2022-41709Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdonpm · electron-markdownify
- CVE-2022-43425Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters onMaven · io.jenkins.plugins:custom-checkbox-parameter
- CVE-2022-43426Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to oMaven · io.jenkins.plugins:s3explorer
- CVE-2022-43429Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be eMaven · com.compuware.jenkins:compuware-topaz-for-total-test
- CVE-2022-43432Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content iMaven · org.jenkins-ci.plugins:xframium
- CVE-2022-43433Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worMaven · io.jenkins.plugins:screenrecorder
- CVE-2022-43435Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worMaven · org.jenkins-ci.plugins.plugin:fireline
- CVE-2022-42188In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.Packagist · lavalite/cms
- CVE-2022-35698Adobe Commerce Stored XSS Arbitrary code executionPackagist · magento/community-edition, magento/project-community-edition
- CVE-2022-37602Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.npm · grunt-karma
- CVE-2022-37614Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via npm · mockery
- CVE-2022-40871Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.Packagist · dolibarr/dolibarr
- CVE-2022-32174Gogs - XSSGo · gogs.io/gogs
- CVE-2022-40440mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.npm · mxgraph
- CVE-2022-41376Metro UI v4.4.0 to v4.5.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function.npm · metro4
- CVE-2022-41380The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-yaml, democritus-file-system
- CVE-2022-41381The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-utility, democritus-file-system
- CVE-2022-41382The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-json, democritus-file-system
- CVE-2022-41383The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-archives, democritus-file-system
- CVE-2022-41384The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-domains, democritus-urls
- CVE-2022-41385The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-html, democritus-urls
- CVE-2022-41386The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-utility, democritus-urls
- CVE-2022-41387The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-pdfs, democritus-urls
- CVE-2022-41404An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (Maven · org.ini4j:ini4j
- CVE-2022-42036The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-urls, democritus-csv
- CVE-2022-42037The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-asns, democritus-csv
- CVE-2022-42039The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-lists, democritus-dicts
- CVE-2022-42040The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-algorithms, democritus-dicts