Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21629A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a projecMaven · org.jenkins-ci.plugins:build-with-parameters · fixed in 1.5.1
- CVE-2021-21628Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scriMaven · org.jenkins-ci.plugins:build-with-parameters · fixed in 1.5.1
- CVE-2021-26919Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.Maven · org.apache.druid:druid · fixed in 0.20.2
- CVE-2021-20289A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final.Maven · org.jboss.resteasy:resteasy-core · fixed in 4.6.1, 4.5.10, 3.16.0
- CVE-2021-26715The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability.Maven · org.mitre:openid-connect-server
- CVE-2021-21380Rating Script Service expose XWiki to SQL injectionMaven · org.xwiki.platform:xwiki-platform-ratings-api · fixed in 12.9
- CVE-2021-28099In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories wMaven · com.netflix.hollow:hollow
- CVE-2021-28100Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--.Maven · com.netflix.priam:priam
- CVE-2021-20222A flaw was found in keycloak.Maven · org.keycloak:keycloak-parent · fixed in 12.0.3
- CVE-2021-21348XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)Maven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21349A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21350XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21351XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21341XStream can cause a Denial of ServiceMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21342A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21343XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21344XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21345XStream is vulnerable to a Remote Command Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21346XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-21347XStream is vulnerable to an Arbitrary Code Execution attackMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.16
- CVE-2021-27906A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the fileMaven · org.apache.pdfbox:pdfbox · fixed in 2.0.23
- CVE-2021-27807A carefully crafted PDF file can trigger an infinite loop while loading the fileMaven · org.apache.pdfbox:pdfbox · fixed in 2.0.23
- CVE-2021-21626Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowMaven · io.jenkins.plugins:warnings-ng · fixed in 8.5.0
- CVE-2021-21627A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domMaven · org.jenkins-ci.plugins:libvirt-slave · fixed in 1.9.1
- CVE-2021-21625Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowinMaven · org.jenkins-ci.plugins:aws-credentials · fixed in 1.28.1
- CVE-2021-21624An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permissionMaven · org.jenkins-ci.plugins:role-strategy · fixed in 3.1.1
- CVE-2021-21623An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission oMaven · org.jenkins-ci.plugins:matrix-auth · fixed in 2.6.6
- CVE-2021-20218A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after.Maven · io.fabric8:kubernetes-client · fixed in 4.7.2, 4.11.2, 4.13.2 and more
- CVE-2020-1926Timing attack in Cookie signature verificationMaven · org.apache.hive:hive · fixed in 2.3.8
- CVE-2021-27576Apache OpenMeetings: bandwidth can be overloaded with public web serviceMaven · org.apache.openmeetings:openmeetings-parent · fixed in 6.0.0