Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-29451Missing validation of JWT signature in `ManyDesigns/Portofino`Maven · com.manydesigns:portofino-core, com.manydesigns:portofino-dispatcher · fixed in 5.2.1
- CVE-2021-26074Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a JaMaven · com.atlassian.connect:atlassian-connect-spring-boot-starter · fixed in 2.1.3
- CVE-2021-27850Bypass of the fix for CVE-2019-0195Maven · org.apache.tapestry:tapestry-core · fixed in 5.6.3, 5.7.1
- CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IOMaven · com.cosium.vet:vet, com.diamondq.common:common-thirdparty.jcasbin +8 · fixed in 2.7
- CVE-2021-29943Apache Solr Unprivileged users may be able to perform unauthorized read/write to collectionsMaven · org.apache.solr:solr-parent · fixed in 8.8.2
- CVE-2021-29262Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settingsMaven · org.apache.solr:solr-core · fixed in 8.8.2
- CVE-2021-27905SSRF vulnerability with the Replication handlerMaven · org.apache.solr:solr-parent · fixed in 8.8.2
- CVE-2021-23369Remote Code Execution (RCE)Maven · org.webjars.bowergithub.wycats:handlebars.js, org.webjars.npm:handlebars +1 · fixed in 4.7.7
- CVE-2021-22512Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin.Maven · org.jenkins-ci.plugins:hp-application-automation-tools-plugin · fixed in 6.8
- CVE-2021-22511Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin.Maven · org.jenkins-ci.plugins:hp-application-automation-tools-plugin · fixed in 6.8
- CVE-2021-22510Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin.Maven · org.jenkins-ci.plugins:hp-application-automation-tools-plugin · fixed in 6.8
- CVE-2021-22513Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin.Maven · org.jenkins-ci.plugins:hp-application-automation-tools-plugin · fixed in 7.2.3-beta
- CVE-2021-21641A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.Maven · org.jenkins-ci.plugins:promoted-builds · fixed in 3.9.1
- CVE-2021-21640Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackersMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.277.2, 2.287
- CVE-2021-21639Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `conMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.277.2, 2.287
- CVE-2021-22696OAuth 2 authorization service vulnerable to DDos attacksMaven · org.apache.cxf:apache-cxf, org.apache.cxf:cxf · fixed in 3.4.3, 3.3.10
- CVE-2021-28164In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segmMaven · org.eclipse.jetty:jetty-webapp · fixed in 9.4.39
- CVE-2021-28165In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.39, 10.0.2, 11.0.2
- CVE-2021-28163In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink,Maven · org.eclipse.jetty:jetty-deploy · fixed in 9.4.39, 10.0.2, 11.0.2
- CVE-2021-28657Infinite loop in Apache Tika's MP3 parserMaven · org.apache.tika:tika · fixed in 1.26
- CVE-2021-21409Possible request smuggling in HTTP/2 due missing validation of content-lengthMaven · io.netty:netty, io.netty:netty-codec-http2 +1 · fixed in 4.1.61.Final
- CVE-2021-21638A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect tMaven · org.jenkins-ci.plugins:tfs
- CVE-2021-21637A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to conMaven · org.jenkins-ci.plugins:tfs
- CVE-2021-21636A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enuMaven · org.jenkins-ci.plugins:tfs
- CVE-2021-21635Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a storeMaven · io.jenkins.plugins:rest-list-parameter · fixed in 1.3.1
- CVE-2021-21634Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the JenkMaven · org.jvnet.hudson.plugins:jabber · fixed in 1.42
- CVE-2021-21633A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to Maven · org.jenkins-ci.plugins:dependency-track · fixed in 3.1.1
- CVE-2021-21632A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to conneMaven · org.jenkins-ci.plugins:dependency-track · fixed in 3.1.1
- CVE-2021-21631Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReMaven · org.jenkins-ci.plugins:cloud-stats · fixed in 0.27
- CVE-2021-21630Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-sMaven · org.jenkins-ci.plugins:extra-columns · fixed in 1.23