Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-31412Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19Maven · com.vaadin:vaadin-bom · fixed in 10.0.19, 14.6.2, 19.0.9
- CVE-2021-33604Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19Maven · com.vaadin:vaadin-bom · fixed in 14.6.2, 19.0.9
- CVE-2021-29620XXE vulnerability on Launch import with externally-defined DTD fileMaven · com.epam.reportportal:service-api · fixed in 5.4.0
- CVE-2021-34428For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, thMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.41, 10.0.3, 11.0.3
- CVE-2010-3300It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.Maven · org.owasp.esapi:esapi · fixed in 2.0GA
- CVE-2021-29061A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when thMaven · com.github.fracpete:vfsjfilechooser2 · fixed in 0.2.9
- CVE-2021-21669Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:generic-webhook-trigger · fixed in 1.74
- CVE-2021-21668Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability explMaven · org.jenkins-ci.plugins:scriptler · fixed in 3.2
- CVE-2021-21667Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site Maven · org.jenkins-ci.plugins:scriptler · fixed in 3.3
- CVE-2021-30468Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriterMaven · org.apache.cxf:apache-cxf, org.apache.cxf:cxf · fixed in 3.4.4, 3.3.11
- CVE-2021-33813An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.Maven · org.jdom:jdom, org.jdom:jdom2 · fixed in 2.0.6.1
- CVE-2021-32623Opencast vulnerable to billion laughs attack (XML bomb)Maven · org.opencastproject:opencast-kernel · fixed in 9.6
- CVE-2021-31811A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny fileMaven · org.apache.pdfbox:pdfbox, org.apache.pdfbox:pdfbox-parent · fixed in 2.0.24
- CVE-2021-31812A carefully crafted PDF file can trigger an infinite loop while loading the fileMaven · org.apache.pdfbox:pdfbox, org.apache.pdfbox:pdfbox-parent · fixed in 2.0.24
- CVE-2021-21665A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to anMaven · com.xebialabs.deployit.ci:deployit-plugin · fixed in 10.0.2
- CVE-2021-21666Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a Maven · org.jenkins-ci.plugins:kiuwanjenkinsplugin · fixed in 1.6.1
- CVE-2021-21663A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect Maven · com.xebialabs.deployit.ci:deployit-plugin · fixed in 10.0.2
- CVE-2021-21664An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to coMaven · com.xebialabs.deployit.ci:deployit-plugin · fixed in 10.0.2
- CVE-2021-21662A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumeraMaven · com.xebialabs.deployit.ci:deployit-plugin · fixed in 10.0.2
- CVE-2021-21661Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with OveraMaven · org.jenkins-ci.plugins:kubernetes-cli · fixed in 1.10.1
- CVE-2021-20293A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly hMaven · org.jboss.resteasy:resteasy-bom, org.jboss.resteasy:resteasy-core
- CVE-2021-29049Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 beforeMaven · com.liferay.portal:release.dxp.bom · fixed in 7.0.10.fp99, 7.1.10.fp23, 7.2.10.fp12 and more
- CVE-2021-28169For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to aMaven · org.eclipse.jetty:jetty-servlets · fixed in 9.4.41, 10.0.3, 11.0.3
- CVE-2020-1719A flaw was found in wildfly.Maven · org.wildfly.bom:wildfly · fixed in 20.0.0.Final
- CVE-2020-6950Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.Maven · org.glassfish:mojarra-parent · fixed in 2.3.14
- CVE-2020-35510A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001.Maven · org.jboss.remoting:jboss-remoting · fixed in 5.0.20.Final
- CVE-2020-14340A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage colMaven · org.jboss.xnio:xnio-nio · fixed in 3.8.2.Final, 3.7.9.Final
- CVE-2020-14326A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes.Maven · org.jboss.resteasy:resteasy-bom · fixed in 4.5.6.Final
- CVE-2021-3424A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible.Maven · org.keycloak:keycloak-services · fixed in 18.0.0
- CVE-2021-31684A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of seMaven · net.minidev:json-smart · fixed in 1.3.3, 2.4.4