Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-3005Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmPackagist · yetiforce/yetiforce-crm
- CVE-2022-3004Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmPackagist · yetiforce/yetiforce-crm
- CVE-2022-3000Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmPackagist · yetiforce/yetiforce-crm
- CVE-2022-2924Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmPackagist · yetiforce/yetiforce-crm
- CVE-2022-37258Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convnpm · steal
- CVE-2022-37260A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js.npm · steal
- CVE-2022-37264Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.npm · steal
- CVE-2022-37262A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.npm · steal
- CVE-2022-37257Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npmnpm · steal
- CVE-2022-37266Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.npm · steal
- CVE-2022-38352ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.Packagist · topthink/framework
- CVE-2022-37724Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all Maven · wonder:wonder
- CVE-2022-40365Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname Go · github.com/ouqiang/gocron
- CVE-2022-38796A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header.Packagist · feehi/cms
- CVE-2022-37767Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.Maven · io.pebbletemplates:pebble
- CVE-2022-38639A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted npm · markdown-nice
- CVE-2022-36376WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerabilityPackagist · rankmath/seo-by-rank-math
- CVE-2022-37189DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service.PyPI · mei2volpiano
- CVE-2022-30331The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper valiPyPI · pytigergraph
- CVE-2022-25646Cross-site Scripting (XSS)npm · x-data-spreadsheet
- CVE-2020-26938In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and tokennpm · oauth2-server
- CVE-2022-37059Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login FieldPackagist · intelliants/subrion
- CVE-2022-25921Arbitrary Code Executionnpm · morgan-json
- CVE-2022-25644Arbitrary Code Executionnpm · @pendo324/get-process-by-name
- CVE-2022-21165Arbitrary Command Injectionnpm · font-converter
- CVE-2022-36573A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted paPackagist · pagekit/pagekit
- CVE-2022-38792The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.PyPI · exotel
- CVE-2022-0084A flaw was found in XNIO, specifically in the notifyReadClosed method.Maven · org.jboss.xnio:xnio-all
- CVE-2021-3563A flaw was found in openstack-keystone.PyPI · keystone
- CVE-2022-36527Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field unMaven · com.jflyfox:jflyfox_jfinal