Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-34209A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-sMaven · org.jenkins-ci.plugins:threadfix
- CVE-2022-34208A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an Maven · org.jenkins-ci.plugins:beaker-builder
- CVE-2022-34207A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attackMaven · org.jenkins-ci.plugins:beaker-builder
- CVE-2022-34206A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTMaven · org.jenkins-ci.plugins:jianliao
- CVE-2022-34205A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POSTMaven · org.jenkins-ci.plugins:jianliao
- CVE-2022-34204A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-Maven · com.geteasyqa:easyqa
- CVE-2022-34203A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specifMaven · com.geteasyqa:easyqa
- CVE-2022-34202Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where theMaven · com.geteasyqa:easyqa
- CVE-2022-34201A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to conMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-34200A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect tMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-34199Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller wheMaven · com.convertigo.jenkins.plugins:convertigo-mobile-platform
- CVE-2022-34198Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displayMaven · org.jenkins-ci.plugins:stashbranchparameter
- CVE-2022-34195Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on viMaven · org.jenkins-ci.plugins:repository-connector
- CVE-2022-34194Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parametersMaven · org.jenkins-ci.plugins:readonly-parameters
- CVE-2022-34193Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resuMaven · org.lilicurroad.jenkins:packageversion
- CVE-2022-34192Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, andMaven · org.jenkins-ci.plugins:ontrack
- CVE-2022-34190Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact vMaven · eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin
- CVE-2022-34189Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parMaven · org.jenkins-ci.plugins:image-tag-parameter
- CVE-2022-34187Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters oMaven · aendter.jenkins.plugins:filesystem-list-parameter-plugin
- CVE-2022-34186Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parametMaven · com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter
- CVE-2022-34185Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, Maven · me.leejay.jenkins:date-parameter
- CVE-2022-34184Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameterMaven · org.jenkins-ci.plugins:crx-content-package-deployer
- CVE-2022-34183Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displayinMaven · io.jenkins.plugins:agent-server-parameter
- CVE-2022-32549log injection in Sling loggingMaven · org.apache.sling:org.apache.sling.api, org.apache.sling:org.apache.sling.commons.log
- CVE-2022-2130Cross-site Scripting (XSS) - Reflected in microweber/microweberPackagist · microweber/microweber
- CVE-2022-25871Prototype Pollutionnpm · querymen
- CVE-2022-25872Out-of-bounds Readnpm · fast-string-search
- CVE-2022-22138Denial of Service (DoS)npm · fast-string-search
- CVE-2022-29894Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function.npm · strapi
- CVE-2021-41502An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScriPackagist · intelliants/subrion