Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-34804Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuratMaven · org.jenkins-ci.plugins:opsgenie
- CVE-2022-34803Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the JenkMaven · org.jenkins-ci.plugins:opsgenie
- CVE-2022-34802Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration filMaven · org.jenkins-ci.plugins:rocketchatnotifier
- CVE-2022-34801Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentMaven · tools.devnull:build-notifications
- CVE-2022-34800Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller wMaven · tools.devnull:build-notifications
- CVE-2022-34799Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controlMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34798Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers witMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34797A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to aMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34796A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34795Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stMaven · org.jenkins-ci.plugins:ec2-deployment-dashboard
- CVE-2022-34794Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to aMaven · org.jenkins-ci.plugins:recipe
- CVE-2022-34793Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:recipe
- CVE-2022-34792A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an atMaven · org.jenkins-ci.plugins:recipe
- CVE-2022-34791Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stMaven · io.jenkins.plugins:validating-email-parameter
- CVE-2022-34790Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scrMaven · org.jenkins-ci.plugins:xfpanel
- CVE-2022-34789A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous mMaven · net.praqma:matrix-reloaded
- CVE-2022-34788Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSSMaven · net.praqma:matrix-reloaded
- CVE-2022-34787Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-siteMaven · hudson.plugins:project-inheritance
- CVE-2022-34786Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-Maven · org.jenkins-ci.plugins:rich-text-publisher-plugin
- CVE-2022-34785Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Maven · org.jenkins-ci.plugins:build-metrics
- CVE-2022-34784Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS)Maven · org.jenkins-ci.plugins:build-metrics
- CVE-2021-40663deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollutinpm · deep.assign
- CVE-2022-31110Denial of Service (DoS) vulnerability in RSSHubnpm · rsshub
- CVE-2022-33107ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\StorPackagist · topthink/framework
- CVE-2022-21231Prototype Pollutionnpm · deep-get-set
- CVE-2022-33113Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field underMaven · com.jfinal:jfinal
- CVE-2022-34213Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the JMaven · org.jenkins-ci.plugins:squashtm-publisher
- CVE-2022-34212A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an Maven · org.jenkins-ci.plugins:vmware-vrealize-orchestrator
- CVE-2022-34211A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP PMaven · org.jenkins-ci.plugins:vmware-vrealize-orchestrator
- CVE-2022-34210A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:threadfix