Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21680Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:nested-view · fixed in 1.21
- CVE-2021-21679Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URLMaven · org.jenkins-ci.plugins:azure-ad · fixed in 180.v8b1e80e6f242
- CVE-2021-21678Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.Maven · org.jenkins-ci.plugins:saml · fixed in 2.0.8
- CVE-2021-21677Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializesMaven · io.jenkins.plugins:code-coverage-api · fixed in 1.4.1
- CVE-2021-39177User impersonation due to incorrect handling of the login JWTMaven · org.geysermc:connector · fixed in 1.4.2-SNAPSHOT
- CVE-2021-39133Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck serverMaven · org.rundeck:rundeck-core · fixed in 3.4.3, 3.3.14
- CVE-2021-39132YAML deserialization can run untrusted codeMaven · org.rundeck:rundeck-core · fixed in 3.4.3, 3.3.14
- CVE-2021-33605Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20Maven · com.vaadin:vaadin-checkbox-flow · fixed in 14.6.8, 20.0.6
- CVE-2021-39150A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshalingMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39152A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshalingMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39140XStream can cause a Denial of ServiceMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39149XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39148XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39147XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39146XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39145XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39141XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39153XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39151XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39139XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39154XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-39144XStream is vulnerable to a Remote Command Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.18
- CVE-2021-28490In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.Maven · org.owasp:csrfguard · fixed in 4.0.0
- CVE-2021-37714Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptionsMaven · org.jsoup:jsoup · fixed in 1.14.2
- CVE-2021-32827Arbitrary code execution in MockServerMaven · org.mock-server:mockserver
- CVE-2020-28088An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2021-3642A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer maMaven · org.wildfly.security:wildfly-elytron · fixed in 1.10.14, 1.15.5, 1.16.1
- CVE-2021-34371Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSesMaven · org.neo4j:neo4j · fixed in 3.5.0
- CVE-2021-35463Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary wMaven · com.liferay.portal:release.portal.bom, com.liferay:com.liferay.frontend.taglib.clay · fixed in 7.4.1, 7.1.15
- CVE-2021-33337Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and LiferMaven · com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.document.library.web · fixed in 7.1.10.fp20, 7.2.10.fp9, 5.0.54