Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21428Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generatorMaven · org.openapitools:openapi-generator-online · fixed in 5.1.0
- CVE-2021-26077Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian CMaven · com.atlassian.connect:atlassian-connect-spring-boot · fixed in 2.1.3, 2.1.5
- CVE-2021-31409Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19Maven · com.vaadin:vaadin-compatibility-server · fixed in 8.13.0
- CVE-2021-31411Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19Maven · com.vaadin:vaadin-bom · fixed in 14.5.3, 19.0.5
- CVE-2021-31164Apache Unomi log injectionMaven · org.apache.unomi:unomi · fixed in 1.5.5
- CVE-2021-29441Authentication bypassMaven · com.alibaba.nacos:nacos-common · fixed in 1.4.1
- CVE-2021-29442Authentication bypassMaven · com.alibaba.nacos:nacos-common · fixed in 1.4.1
- CVE-2021-21429Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven pluginMaven · org.openapitools:openapi-generator-maven-plugin · fixed in 5.1.0
- CVE-2021-30638An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and laterMaven · org.apache.tapestry:tapestry-core · fixed in 5.6.4, 5.7.2
- CVE-2021-31408Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19Maven · com.vaadin:vaadin-bom · fixed in 19.0.4
- CVE-2021-31407Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19Maven · com.vaadin:flow-server · fixed in 2.4.8, 6.0.1
- CVE-2021-31406Timing side channel vulnerability in endpoint request handler in Vaadin 15-19Maven · com.vaadin:flow-server · fixed in 5.0.4, 6.0.1
- CVE-2021-31405Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17Maven · com.vaadin:vaadin-bom · fixed in 14.4.4, 17.0.11
- CVE-2021-31404Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18Maven · com.vaadin:flow-server · fixed in 1.0.14, 2.4.7, 5.0.3
- CVE-2021-31403Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8Maven · com.vaadin:vaadin-bom, com.vaadin:vaadin-server · fixed in 7.7.24, 8.12.3
- CVE-2020-36321Directory traversal in development mode handler in Vaadin 14 and 15-17Maven · com.vaadin:flow-server · fixed in 5.0.0, 2.4.2
- CVE-2020-36320Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7Maven · com.vaadin:vaadin-bom, com.vaadin:vaadin-server · fixed in 7.7.22
- CVE-2020-36319Potential sensitive data exposure in applications using Vaadin 15Maven · com.vaadin:flow-server · fixed in 3.0.6
- CVE-2019-25028Stored cross-site scripting in Grid component in Vaadin 7 and 8Maven · com.vaadin:vaadin-bom, com.vaadin:vaadin-server · fixed in 7.7.20, 8.8.5
- CVE-2019-25027Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13Maven · com.vaadin:flow-server · fixed in 1.0.11, 1.4.3
- CVE-2018-25007Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11Maven · com.vaadin:flow-server · fixed in 1.0.6
- CVE-2021-26291block repositories using http by defaultMaven · org.apache.maven:maven-compat, org.apache.maven:maven-core · fixed in 3.8.1
- CVE-2021-28168Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability.Maven · org.glassfish.jersey.core:jersey-common · fixed in 2.34, 3.0.2
- CVE-2021-21647Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read peMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.18.1, 1.1.22
- CVE-2021-21646Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackeMaven · org.jenkins-ci.plugins:templating-engine · fixed in 2.2
- CVE-2021-21645Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/RMaven · org.jenkins-ci.plugins:config-file-provider · fixed in 3.7.1
- CVE-2021-21644A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configMaven · org.jenkins-ci.plugins:config-file-provider · fixed in 3.7.1
- CVE-2021-21642Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:config-file-provider · fixed in 3.7.1
- CVE-2021-21643Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attacMaven · org.jenkins-ci.plugins:config-file-provider · fixed in 3.7.1
- CVE-2021-29459XSS Cross Site ScriptingMaven · org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-web · fixed in 12.6.3, 12.8