Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-36374Apache Ant ZIP, and ZIP based, archive denial of service vulerabilityMaven · org.apache.ant:ant · fixed in 1.9.16, 1.10.11
- CVE-2021-36373Apache Ant TAR archive denial of service vulnerabilityMaven · org.apache.ant:ant · fixed in 1.9.16, 1.10.11
- CVE-2021-36090Apache Commons Compress 1.0 to 1.20 denial of service vulnerabilityMaven · org.apache.commons:commons-compress · fixed in 1.21
- CVE-2021-35517Apache Commons Compress 1.1 to 1.20 denial of service vulnerabilityMaven · org.apache.commons:commons-compress · fixed in 1.21
- CVE-2021-35516Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityMaven · org.apache.commons:commons-compress · fixed in 1.21
- CVE-2021-35515Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityMaven · org.apache.commons:commons-compress · fixed in 1.21
- CVE-2021-33037Incorrect Transfer-Encoding handling with HTTP/1.0Maven · org.apache.tomcat:tomcat · fixed in 10.0.7, 9.0.48, 8.5.68
- CVE-2021-30640Auth weakness in JNDIRealmMaven · org.apache.tomcat:tomcat · fixed in 10.0.5, 9.0.45, 8.5.65
- CVE-2021-30639DoS after non-blocking IO errorMaven · org.apache.tomcat:tomcat · fixed in 10.0.5, 9.0.45, 8.5.65
- CVE-2021-30129DoS/OOM leak vulnerability in Apache Mina SSHD ServerMaven · org.apache.sshd:sshd-core, org.apache.sshd:sshd-mina · fixed in 2.7.0
- CVE-2021-3637A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessiMaven · org.keycloak:keycloak-model-infinispan · fixed in 14.0.0
- CVE-2021-33192Display information UI XSSMaven · org.apache.jena:jena-fuseki · fixed in 4.1.0
- CVE-2021-26920Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intendedMaven · org.apache.druid:druid-core · fixed in 0.21.0
- CVE-2021-32731The reset password form reveal users email addressMaven · org.xwiki.platform:xwiki-platform-web · fixed in 13.2
- CVE-2021-32730No CSRF protection on the password change formMaven · org.xwiki.platform:xwiki-platform-administration-ui · fixed in 12.10.5, 13.2
- CVE-2021-32729A user without PR can reset user authentication failures informationMaven · org.xwiki.platform:xwiki-platform-security-authentication-script · fixed in 12.6.8, 12.10.4
- CVE-2021-21676Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReMaven · org.jenkins-ci.plugins:requests · fixed in 2.2.8
- CVE-2021-21675A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests aMaven · org.jenkins-ci.plugins:requests · fixed in 2.2.13
- CVE-2021-21674A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the lisMaven · org.jenkins-ci.plugins:requests · fixed in 2.2.7
- CVE-2021-21673Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attMaven · org.jenkins-ci.plugins:cas-plugin · fixed in 1.6.1
- CVE-2021-21672Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:seleniumhtmlreport · fixed in 1.1
- CVE-2021-21671Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.300, 2.289.2
- CVE-2021-21670Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/CancMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.289.2, 2.300
- CVE-2021-29485Remote Code Execution Vulnerability in Session StorageMaven · io.ratpack:ratpack-core · fixed in 1.9.0
- CVE-2021-29481Client side sessions should not allow unencrypted storageMaven · io.ratpack:ratpack-session · fixed in 1.9.0
- CVE-2021-29480Default client side session signing key is highly predictableMaven · io.ratpack:ratpack-session · fixed in 1.9.0
- CVE-2021-22119Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a DeMaven · org.springframework.security:spring-security-core, org.springframework.security:spring-security-oauth2-client · fixed in 5.5.1, 5.4.7, 5.3.10 and more
- CVE-2021-29479Cached redirect poisoning via X-Forwarded-Host headerMaven · io.ratpack:ratpack-core · fixed in 1.9.0
- CVE-2021-31649In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code exMaven · com.jfinal:jfinal
- CVE-2021-33348An issue was discovered in JFinal framework v4.9.10 and below.Maven · com.jfinal:jfinal · fixed in 4.9.11