Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-31268A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-IMaven · com.gitblit:gitblit
- CVE-2022-24434Denial of Service (DoS)npm · dicer
- CVE-2022-21195Regular Expression Denial of Service (ReDoS)PyPI · url-regex
- CVE-2022-28990WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.PyPI · pywasm3
- CVE-2021-41938An issue was discovered in ShopXO CMS 2.2.0.Packagist · shopxo/shopxo
- CVE-2019-25061The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due toRubyGems · random_password_generator
- CVE-2022-30972A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse Maven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2022-30971Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2022-30970Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names inMaven · org.jenkins-ci.plugins:autocomplete-parameter
- CVE-2022-30969A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitMaven · org.jenkins-ci.plugins:autocomplete-parameter
- CVE-2022-30968Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, Maven · org.jenkins-ci.plugins:vboxwrapper
- CVE-2022-30967Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on viewMaven · org.jvnet.hudson.plugins:selection-tasks-plugin
- CVE-2022-30966Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displayMaven · org.jenkins-ci.plugins:random-string-parameter
- CVE-2022-30965Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views dispMaven · org.jenkins-ci.plugins:promoted-builds-simple
- CVE-2022-30963Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resuMaven · org.jenkins-ci.plugins:jdk_parameter_plugin
- CVE-2022-30962Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameterMaven · org.jenkins-ci.plugins:global-variable-string-parameter
- CVE-2022-30961Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters Maven · org.jenkins-ci.plugins:autocomplete-parameter
- CVE-2022-30959A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-sMaven · org.jenkins-ci.plugins:ssh
- CVE-2022-30958A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specifiMaven · org.jenkins-ci.plugins:ssh
- CVE-2022-30957A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDMaven · org.jenkins-ci.plugins:ssh
- CVE-2022-29623An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary cnpm · connect-multiparty
- CVE-2022-25862Prototype Pollutionnpm · sds
- CVE-2022-1397API Privilege Escalation in alextselegidis/easyappointmentsPackagist · alextselegidis/easyappointments
- CVE-2022-25324Denial of Service (DoS)npm · bignum
- CVE-2022-28508An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2.Packagist · mantisbt/mantisbt
- CVE-2022-1555DOM XSS in microweber ver 1.2.15 in microweber/microweberPackagist · microweber/microweber
- CVE-2022-28118SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.npm · siteserver
- CVE-2021-40822GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.Maven · org.geoserver:gs-main
- CVE-2022-25301Prototype Pollutionnpm · jsgui-lang-essentials
- CVE-2022-25767Remote Code ExecutionMaven · com.bstek.ureport:ureport2-console