Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21684Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying themMaven · org.jenkins-ci.plugins:git · fixed in 4.8.3
- CVE-2021-21683The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting iMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.303.2, 2.315
- CVE-2021-21682Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replaMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.315, 2.303.2
- CVE-2021-41862AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).Maven · com.googlecode.aviator:aviator
- CVE-2021-41616Apache ddlutils 1.0 readobject vulnerabilityMaven · org.apache.ddlutils:ddlutils
- CVE-2021-25959OpenCRX - Reflected Cross-Site Scripting in Password Reset FunctionalityMaven · org.opencrx:opencrx-client, org.opencrx:opencrx-core +3 · fixed in 5.2.0
- CVE-2021-36749Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)Maven · org.apache.druid:druid-core · fixed in 0.22.0
- CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and ClientsMaven · org.apache.kafka:kafka-clients, org.apache.kafka:kafka_2.11 +2 · fixed in 2.6.3, 2.7.2, 2.8.1
- CVE-2021-41084Response Splitting from unsanitized headers in http4sMaven · org.http4s:http4s-client_2.12, org.http4s:http4s-client_2.13 +7 · fixed in 0.21.29, 0.22.5, 0.23.4
- CVE-2021-40690Bypass of the secureValidation propertyMaven · org.apache.santuario:xmlsec · fixed in 2.2.3, 2.1.7
- CVE-2021-41303Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypassMaven · org.apache.shiro:shiro-core · fixed in 1.8.0
- CVE-2021-41079Apache Tomcat DoS with unexpected TLS packetMaven · org.apache.tomcat:tomcat · fixed in 10.0.4, 9.0.44, 8.5.64
- CVE-2021-39239XML External Entity (XXE) vulnerabilityMaven · org.apache.jena:jena-core · fixed in 4.2.0
- CVE-2020-21125An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.Maven · com.bstek.ureport:ureport2-core
- CVE-2020-21122UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.Maven · com.bstek.ureport:ureport2-console
- CVE-2021-22147Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots.Maven · org.elasticsearch:elasticsearch · fixed in 7.14.0
- CVE-2021-40824A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) befMaven · org.matrix.android:matrix-android-sdk2 · fixed in 1.2.2
- CVE-2021-40146A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.javaMaven · org.apache.any23:apache-any23 · fixed in 2.5
- CVE-2021-38555An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.javaMaven · org.apache.any23:apache-any23 · fixed in 2.5
- CVE-2021-37579Bypass deserialization checks in Apache DubboMaven · org.apache.dubbo:dubbo · fixed in 2.7.13, 3.0.2
- CVE-2021-36161Unprotected input value toString cause RCEMaven · org.apache.dubbo:dubbo · fixed in 2.7.13
- CVE-2021-40143Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection.Maven · org.sonatype.nexus:nexus-repository · fixed in 3.34.0-01
- CVE-2021-39194Denial of service while parsing polymorphic input with tagged polymorphism style in kamlMaven · com.charleskorn.kaml:kaml · fixed in 0.35.3
- CVE-2021-36163Unsafe deserialization in providers using the Hessian protocolMaven · org.apache.dubbo:dubbo · fixed in 2.7.13, 2.6.10.1
- CVE-2021-36162Unprotected yaml deserialization cause RCEMaven · org.apache.dubbo:dubbo · fixed in 2.7.13, 3.0.2
- CVE-2019-10095bash command injection in spark interpreterMaven · org.apache.zeppelin:zeppelin · fixed in 0.10.0
- CVE-2020-13929Notebook permissions bypassMaven · org.apache.zeppelin:zeppelin · fixed in 0.10.0
- CVE-2021-27578Cross Site Scripting in markdown interpreterMaven · org.apache.zeppelin:zeppelin · fixed in 0.9.0
- CVE-2021-39185Default CORS config allows any origin with credentialsMaven · org.http4s:http4s-server_2.10, org.http4s:http4s-server_2.11 +4 · fixed in 0.21.27, 0.22.3, 0.23.2
- CVE-2021-21681Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where theMaven · org.jenkins-ci.plugins:nomad · fixed in 0.7.5