Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-14519An issue was discovered in Kirby 2.5.12.Packagist · getkirby/cms
- CVE-2018-14520An issue was discovered in Kirby 2.5.12.Packagist · getkirby/cms
- CVE-2022-37223JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2022-37199JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2022-36008Message length overflow in frontiercrates.io · fc-rpc
- CVE-2022-35174A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML vPackagist · getkirby/starterkit
- CVE-2022-2871Cross-site Scripting (XSS) - Stored in notrinos/notrinoserpPackagist · notrinos/notrinos-erp
- CVE-2022-36599Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.Maven · net.mingsoft:ms-mcms
- CVE-2022-36272Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.Maven · net.mingsoft:ms-mcms
- CVE-2020-23622An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALMaven · org.fourthline.cling:cling-core
- CVE-2022-2822Authentication Bypass by Primary Weakness in octoprint/octoprintPyPI · octoprint
- CVE-2022-25973Arbitrary Command Executionnpm · mc-kill-port
- CVE-2022-37450Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulationGo · github.com/ethereum/go-ethereum
- CVE-2020-28423Command Injectionnpm · monorepo-build
- CVE-2020-28425Command Injectionnpm · curljs
- CVE-2020-28433Command Injectionnpm · node-latex-pdf
- CVE-2020-28434Command Injectionnpm · gitblame
- CVE-2020-28437Command Injectionnpm · heroku-env
- CVE-2020-28451Command Injectionnpm · image-tiler
- CVE-2020-28453Command Injectionnpm · npos-tesseract
- CVE-2022-36447An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0.PyPI · chia-blockchain
- CVE-2022-34140A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary wePackagist · feehi/cms
- CVE-2022-36921A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:coverity
- CVE-2022-36920A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-sMaven · org.jenkins-ci.plugins:coverity
- CVE-2022-36919A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentiMaven · org.jenkins-ci.plugins:coverity
- CVE-2022-36918Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackerMaven · org.jenkins-ci.plugins:buckminster
- CVE-2022-36917A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a Maven · org.jenkins-ci.plugins:google-cloud-backup
- CVE-2022-36916A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manualMaven · org.jenkins-ci.plugins:google-cloud-backup
- CVE-2022-36915Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attaMaven · org.jenkins-ci.plugins:android-signing
- CVE-2022-36914Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing atMaven · org.jenkins-ci.plugins:files-found-trigger