Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-30180Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)Maven · org.apache.dubbo:dubbo · fixed in 2.7.10
- CVE-2021-30179Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filterMaven · com.alibaba:dubbo, org.apache.dubbo:dubbo · fixed in 2.6.9, 2.7.10
- CVE-2021-25640Open Redirect or SSRF vulnerability usage of parseURLMaven · com.alibaba:dubbo, org.apache.dubbo:dubbo · fixed in 2.6.9, 2.7.10
- CVE-2021-25641Dubbo Zookeeper does not check serialization idMaven · com.alibaba:dubbo, org.apache.dubbo:dubbo · fixed in 2.6.9, 2.7.8
- CVE-2021-30181Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)Maven · com.alibaba:dubbo, org.apache.dubbo:dubbo · fixed in 2.6.9, 2.7.10
- CVE-2021-32620Users registered with email verification can self re-activate their disabled accountsMaven · org.xwiki.commons:xwiki-commons-core · fixed in 11.10.13, 12.6.7, 12.10.2
- CVE-2021-32621Script injection without script or programming rights through Gadget titlesMaven · org.xwiki.commons:xwiki-commons-core · fixed in 12.6.7, 12.10.3
- CVE-2021-29505XStream is vulnerable to a Remote Command Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.17
- CVE-2020-1729A flaw was found in SmallRye's API through version 1.6.1.Maven · io.smallrye.config:smallrye-config · fixed in 1.6.2
- CVE-2021-20195A flaw was found in keycloak in versions before 13.0.0.Maven · org.keycloak:keycloak-core · fixed in 13.0.0
- CVE-2020-27826A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API.Maven · org.keycloak:keycloak-core · fixed in 12.0.0
- CVE-2020-10688A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly haMaven · org.jboss.resteasy:resteasy-bom, org.jboss.resteasy:resteasy-core · fixed in 3.11.1.Final, 4.5.3.Final
- CVE-2021-32643StaticFile.fromUrl can leak presence of a directoryMaven · org.http4s:http4s-core · fixed in 0.21.24, 0.22.0-RC1, 0.23.0-RC1 and more
- CVE-2021-22118In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege esMaven · org.springframework:spring-web · fixed in 5.2.15, 5.3.7
- CVE-2021-28170In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be Maven · com.sun.el:el-ri, org.glassfish:jakarta.el +1 · fixed in 3.0.4
- CVE-2020-25724A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided.Maven · org.jboss.resteasy:resteasy-bom · fixed in 2.0-beta-2
- CVE-2021-22160Authentication with JWT allows use of “none”-algorithmMaven · org.apache.pulsar:pulsar · fixed in 2.7.2
- CVE-2021-25934In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meMaven · org.opennms:opennms
- CVE-2021-21660Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (Maven · io.jenkins.plugins:markdown-formatter · fixed in 0.2.0
- CVE-2021-21659Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:urltrigger · fixed in 0.49
- CVE-2021-21657Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:fstrigger · fixed in 0.41
- CVE-2021-21658Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:nuget · fixed in 1.1
- CVE-2021-23937DNS proxy and possible amplification attackMaven · org.apache.wicket:wicket-core · fixed in 9.3.0, 8.12.0, 7.18.0
- CVE-2021-33561A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML vMaven · com.shopizer:shopizer · fixed in 2.17.0
- CVE-2021-33562A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTMMaven · com.shopizer:shopizer · fixed in 2.17.0
- CVE-2021-25933In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through Maven · org.opennms:opennms · fixed in 27.1.1
- CVE-2021-25931In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through Maven · org.opennms:opennms · fixed in 27.1.1
- CVE-2021-25929In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through Maven · org.opennms:opennms · fixed in 27.1.1
- CVE-2021-25930In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through Maven · org.opennms:opennms, org.opennms:opennms-config · fixed in 27.1.1
- CVE-2021-3536A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible tMaven · org.wildfly:wildfly-parent · fixed in 23.0.2.Final