Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-31573The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is uPyPI · chainerrl-visualizer
- CVE-2022-31558The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsaPyPI · shiva
- CVE-2022-31506The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used PyPI · opendiamond
- CVE-2022-35411rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent.PyPI · rpc-py
- CVE-2022-33011Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.Packagist · idno/known
- CVE-2022-32115An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file.Packagist · idno/known
- CVE-2022-31290A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTMPackagist · idno/known
- CVE-2022-30852Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).Packagist · idno/known
- CVE-2022-32061An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to exPackagist · snipe/snipe-it
- CVE-2022-32060An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary coPackagist · snipe/snipe-it
- CVE-2022-32533Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesMaven · org.apache.portals.jetspeed-2:jetspeed-commons
- CVE-2022-2321Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakamaGo · github.com/heroiclabs/nakama/v3
- CVE-2022-2306Insufficient Session Expiration in heroiclabs/nakamaGo · github.com/heroiclabs/nakama
- CVE-2021-43116An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packMaven · com.alibaba.nacos:nacos-client
- CVE-2022-31943MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.Maven · net.mingsoft:ms-mcms
- CVE-2022-25900Command Injectionnpm · git-clone
- CVE-2022-34818Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attMaven · de.einsundeins.jenkins.plugins.failedjobdeactivator:failedjobdeactivator
- CVE-2022-34817A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobMaven · de.einsundeins.jenkins.plugins.failedjobdeactivator:failedjobdeactivator
- CVE-2022-34816Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where Maven · org.jenkins-ci.plugins:hpe-network-virtualization
- CVE-2022-34815A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept peMaven · org.jenkins-ci.plugins:rrod
- CVE-2022-34814Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackMaven · org.jenkins-ci.plugins:rrod
- CVE-2022-34813A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to cMaven · org.jenkins-ci.plugins:xpath-config-viewer
- CVE-2022-34812A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create Maven · org.jenkins-ci.plugins:xpath-config-viewer
- CVE-2022-34811A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to aMaven · org.jenkins-ci.plugins:xpath-config-viewer
- CVE-2022-34810A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentiMaven · net.praqma:rqm-plugin
- CVE-2022-34809Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be Maven · net.praqma:rqm-plugin
- CVE-2022-34808Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller wheMaven · org.jenkins-ci.plugins:cisco-spark
- CVE-2022-34807Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller Maven · org.jenkins-ci.plugins:elasticsearch-query
- CVE-2022-34806Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viMaven · org.jenkins-ci.plugins:jigomerge
- CVE-2022-34805Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller wheMaven · org.jenkins-ci.plugins:skype-notifier