Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21689FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and eMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21688The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject aMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21687Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21686File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21685Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirsMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-21693When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.3, 2.319
- CVE-2021-42697Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote atMaven · com.typesafe.akka:aakka-http-core_2.13.0-m3, com.typesafe.akka:akka-http-core_2.11 +5 · fixed in 10.1.15, 10.2.7
- CVE-2021-33611Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14Maven · com.vaadin:vaadin-bom, org.webjars.bowergithub.vaadin:vaadin-menu-bar · fixed in 14.4.5, 1.2.1
- CVE-2021-27644DolphinScheduler mysql jdbc connector parameters deserialize remote code executionMaven · org.apache.dolphinscheduler:dolphinscheduler-server · fixed in 1.3.6
- CVE-2021-41973Apache MINA HTTP listener DOSMaven · org.apache.mina:mina-core · fixed in 2.1.5, 2.0.22
- CVE-2021-41189Communities and collections administrators can escalate their privilege up to system administratorMaven · org.dspace:dspace-api · fixed in 7.1
- CVE-2021-22097In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a bodyMaven · org.springframework.amqp:spring-amqp · fixed in 2.2.19, 2.3.11
- CVE-2021-22096In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious Maven · org.springframework:spring, org.springframework:spring-core · fixed in 5.2.18, 5.3.11
- CVE-2021-22047In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllersMaven · org.springframework.data:spring-data-rest-core · fixed in 3.4.14, 3.5.6
- CVE-2021-22044In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@ReMaven · org.springframework.cloud:spring-cloud-openfeign-core · fixed in 3.0.5, 2.2.10
- CVE-2021-41182XSS in the `altField` option of the Datepicker widgetMaven · org.webjars.npm:jquery-ui · fixed in 1.13.0
- CVE-2021-41183XSS in `*Text` options of the Datepicker widgetMaven · org.webjars.npm:jquery-ui · fixed in 1.13.0
- CVE-2021-41184XSS in the `of` option of the `.position()` utilMaven · org.webjars.npm:jquery-ui · fixed in 1.13.0
- CVE-2021-40865Unsafe Pre-Authentication Deserialization In WorkersMaven · org.apache.storm:storm · fixed in 2.2.1, 1.2.4, 2.1.1
- CVE-2021-38294Shell Command Injection Vulnerability in Nimbus Thrift ServerMaven · org.apache.storm:storm · fixed in 2.2.1, 2.1.1, 1.2.4
- CVE-2021-2471Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).Maven · mysql:mysql-connector-java · fixed in 8.0.27
- CVE-2021-3869Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpMaven · edu.stanford.nlp:stanford-corenlp · fixed in 4.3.1
- CVE-2021-37136The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocatiMaven · io.netty:netty, io.netty:netty-codec +1 · fixed in 4.1.68.Final
- CVE-2021-37137The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.Maven · io.netty:netty, io.netty:netty-codec +1 · fixed in 4.1.68.Final
- CVE-2021-42575The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.Maven · com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer · fixed in 20211018.1
- CVE-2021-3878Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpMaven · edu.stanford.nlp:stanford-corenlp · fixed in 4.3.1
- CVE-2021-42340DoS via memory leak with WebSocket connectionsMaven · org.apache.tomcat:tomcat · fixed in 10.1.0-M6, 10.0.12, 9.0.54 and more
- CVE-2021-33609Denial of service in DataCommunicator class in Vaadin 8Maven · com.vaadin:vaadin-server · fixed in 8.14.1
- CVE-2021-25738Code exec via yaml parsingMaven · io.kubernetes:client-java · fixed in 11.0.1
- CVE-2021-3312An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privilegesMaven · org.opencms:opencms-core · fixed in 12.0.0