Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-36913Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackersMaven · org.jenkins-ci.plugins:openstack-heat
- CVE-2022-36912A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an aMaven · org.jenkins-ci.plugins:openstack-heat
- CVE-2022-36911A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attackeMaven · org.jenkins-ci.plugins:openstack-heat
- CVE-2022-36909A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check forMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36908A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the eMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36907A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect tMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36906A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an aMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2022-36905Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of LiMaven · eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin
- CVE-2022-36904Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowingMaven · org.jenkins-ci.plugins:repository-connector
- CVE-2022-36903A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumeraMaven · org.jenkins-ci.plugins:repository-connector
- CVE-2022-36902Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulMaven · com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter
- CVE-2022-34529WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.PyPI · pywasm3
- CVE-2022-34971An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code vPackagist · feehi/cms
- CVE-2020-28447Command Injectionnpm · xopen
- CVE-2021-23373Prototype Pollutionnpm · set-deep-prop
- CVE-2020-28455Cross-site Scripting (XSS)npm · markdown-it-toc
- CVE-2020-28435Command Injectionnpm · ffmpeg-sdk
- CVE-2020-28436Command Injectionnpm · google-cloudstorage-commands
- CVE-2020-7678Arbitrary Code Executionnpm · node-import
- CVE-2021-23397Prototype Pollutionnpm · @ianwalter/merge
- CVE-2020-28462Prototype Pollutionnpm · ion-parser
- CVE-2020-28422Command Injectionnpm · git-archive
- CVE-2020-28438Command Injectionnpm · deferred-exec
- CVE-2020-28459Cross-site Scripting (XSS)npm · markdown-it-decorate
- CVE-2020-28443Command Injectionnpm · sonar-wrapper
- CVE-2022-21802Cross-site Scripting (XSS)npm · grapesjs
- CVE-2022-32430An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the applicatioMaven · io.github.talelin:lin-cms-core
- CVE-2020-7641Prototype Pollutionnpm · grunt-util-property
- CVE-2022-25869All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cronpm · angular
- CVE-2022-32114An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafnpm · @strapi/strapi