Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25349Cross-site Scripting (XSS)npm · materialize-css
- CVE-2022-21167Arbitrary Code ExecutionNuGet · masuit.tools.core
- CVE-2022-25844Regular Expression Denial of Service (ReDoS)npm · angular
- CVE-2022-23923Sandbox Bypassnpm · jailed
- CVE-2021-41948A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".Packagist · intelliants/subrion
- CVE-2022-27340MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do.Maven · net.mingsoft:ms-mcms
- CVE-2022-27817SWHKD 1.1.5 consumes the keyboard events of unintended users.crates.io · simple-wayland-hotkey-daemon
- CVE-2020-29653Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter.Packagist · froxlor/froxlor
- CVE-2022-29042Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameterMaven · org.jenkins-ci.plugins:jobgenerator
- CVE-2022-29038Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameteMaven · org.jenkins-ci.plugins:extended-choice-parameter
- CVE-2022-28397An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a craftnpm · ghost
- CVE-2022-27263An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted fnpm · strapi
- CVE-2022-27261An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an npm · express-fileupload
- CVE-2022-27260An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a cranpm · buttercms
- CVE-2022-27139An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted Snpm · ghost
- CVE-2022-29080The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions witnpm · npm-dependency-versions
- CVE-2021-40219Bolt CMS <= 4.2 is vulnerable to Remote Code Execution.Packagist · bolt/core
- CVE-2022-27463Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a craPackagist · wwbn/avideo
- CVE-2022-26585Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.Maven · net.mingsoft:ms-mcms
- CVE-2022-26986SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to Packagist · impresscms/impresscms
- CVE-2021-43464A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modPackagist · intelliants/subrion
- CVE-2021-44138There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to readMaven · com.caucho:resin
- CVE-2022-0088Cross-Site Request Forgery (CSRF) in yourls/yourlsPackagist · yourls/yourls
- CVE-2021-44135pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.Packagist · pagekit/pagekit
- CVE-2021-34257Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's AvPackagist · wpanel/wpanel4-cms
- CVE-2021-43142An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.Maven · com.wutka:jox
- CVE-2022-28160Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controlleMaven · org.jenkins-ci.plugins:selected-tests-executor
- CVE-2022-28159Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in Maven · org.jenkins-ci.plugins:selected-tests-executor
- CVE-2022-28158A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enuMaven · com.surenpi.jenkins:phoenix-autotest
- CVE-2022-28157Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from theMaven · com.surenpi.jenkins:phoenix-autotest