Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-21211Denial of Service (DoS)npm · posix
- CVE-2022-24376Command Injectionnpm · git-promise
- CVE-2022-31830Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.npm · kityminder
- CVE-2022-31313api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.PyPI · api-res-py
- CVE-2022-30877The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.PyPI · keep
- CVE-2022-30875Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.Packagist · dolibarr/dolibarr
- CVE-2022-2016Cross-site Scripting (XSS) - Reflected in neorazorx/facturascriptsPackagist · facturascripts/facturascripts
- CVE-2022-29770XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.Maven · com.xuxueli:xxl-job
- CVE-2020-36534easyii CMS out cross-site request forgeryPackagist · noumo/easyii
- CVE-2022-1988Cross-site Scripting (XSS) - Generic in neorazorx/facturascriptsPackagist · facturascripts/facturascripts
- CVE-2021-34079OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacnpm · docker-tester
- CVE-2021-34080OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shellnpm · ssl-utils
- CVE-2021-34081OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name onpm · gitsome
- CVE-2021-34082OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allnpm · proctree
- CVE-2021-34083Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format.npm · google-it
- CVE-2021-34084OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commnpm · s3-uploader
- CVE-2022-29648A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-FoMaven · com.jflyfox:jflyfox_jfinal
- CVE-2022-29647An issue was discovered in MCMS 5.2.7.Maven · net.mingsoft:ms-mcms
- CVE-2020-28246A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0.npm · formio
- CVE-2022-30349siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).NuGet · sscms
- CVE-2022-30506An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP fiMaven · net.mingsoft:ms-mcms
- CVE-2022-29637An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.Go · github.com/mindoc-org/mindoc
- CVE-2022-30500Jfinal cms 5.1.0 is vulnerable to SQL Injection.Maven · com.jflyfox:jflyfox_jfinal
- CVE-2022-30427In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.Go · github.com/gphper/ginadmin
- CVE-2022-30428In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.Go · github.com/gphper/ginadmin
- CVE-2022-29362A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scNuGet · zkeacms.publisher
- CVE-2021-42656SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.NuGet · sscms
- CVE-2021-42655SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.NuGet · sscms
- CVE-2022-29305imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost.Packagist · helloxz/imgurl
- CVE-2022-29002A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-Maven · com.xuxueli:xxl-job