Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-42041The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-file-system, democritus-hashes
- CVE-2022-42042The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-networking, democritus-hashes
- CVE-2022-42043The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-xml, democritus-html
- CVE-2022-42044The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.PyPI · d8s-asns, democritus-html
- CVE-2022-42092Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.Packagist · backdrop/backdrop
- CVE-2022-3002Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmPackagist · yetiforce/yetiforce-crm
- CVE-2022-38817Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.Go · github.com/dapr/dashboard
- CVE-2022-40923A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (PyPI · lief
- CVE-2022-40277Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdnpm · joplin
- CVE-2022-40931dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).Go · github.com/dutchcoders/transfer.sh
- CVE-2022-40408FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box undPackagist · feehi/feehicms
- CVE-2022-32169bytebase - Improper AuthorizationGo · github.com/bytebase/bytebase
- CVE-2022-32170bytebase - Improper AuthorizationGo · github.com/bytebase/bytebase
- CVE-2022-40929XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.Maven · com.xuxueli:xxl-job-core
- CVE-2022-40199Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a rPackagist · ec-cube/ec-cube
- CVE-2022-38975DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary scPackagist · ec-cube/ec-cube
- CVE-2022-23463SpEL Injection in Nepxion DiscoveryMaven · com.nepxion:discovery
- CVE-2022-23464Potential Server Side Request Forgery (SSRF) in Nepxion DiscoveryMaven · com.nepxion:discovery
- CVE-2022-23461Cross-Site Scripting (XSS) in Jodit Editornpm · jodit
- CVE-2022-39242Incorrect Calculation in Frontier leads to inflated Ethereum chain gas pricescrates.io · pallet-ethereum
- CVE-2022-34026ICEcoder v8.1 allows attackers to execute a directory traversal.Packagist · icecoder/icecoder
- CVE-2022-40705Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTPMaven · soap:soap
- CVE-2022-41255Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it canMaven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41254Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attackerMaven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41253A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-speMaven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41252Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID Maven · org.jenkins-ci.plugins:cons3rt
- CVE-2022-41250A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an aMaven · com.meowlomo.jenkins:scm-httpclient
- CVE-2022-41251A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IMaven · org.jenkins-ci.plugins:apprenda
- CVE-2022-41249A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attackeMaven · com.meowlomo.jenkins:scm-httpclient
- CVE-2022-41248Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potenMaven · org.jenkins-ci.plugins:bigpanda-jenkins