Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-27576Apache OpenMeetings: bandwidth can be overloaded with public web serviceMaven · org.apache.openmeetings:openmeetings-parent · fixed in 6.0.0
- CVE-2021-21379It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macroMaven · org.xwiki.platform:xwiki-platform-rendering-wikimacro-store · fixed in 11.10.11, 12.6.3, 12.8
- CVE-2020-36282JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution viaMaven · com.rabbitmq.jms:rabbitmq-jms · fixed in 2.2.0, 1.15.2
- CVE-2021-21363Generator Web Application: Local Privilege Escalation Vulnerability via System Temp DirectoryMaven · io.swagger:swagger-codegen · fixed in 2.4.19
- CVE-2021-21364Generated Code Contains Local Information Disclosure VulnerabilityMaven · io.swagger:swagger-codegen · fixed in 2.4.19
- CVE-2020-13936Velocity Sandbox BypassMaven · org.apache.velocity:velocity, org.apache.velocity:velocity-engine-parent · fixed in 2.3
- CVE-2020-13959Velocity Tools XSS VulnerabilityMaven · org.apache.velocity.tools:velocity-tools-parent, org.apache.velocity:velocity-tools · fixed in 3.1
- CVE-2021-21295Possible request smuggling in HTTP/2 due missing validationMaven · io.netty:netty, io.netty:netty-codec-http2 +1 · fixed in 4.1.60.Final
- CVE-2021-20262A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password.Maven · org.keycloak:keycloak-core
- CVE-2021-21361Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-pluginMaven · com.bmuschko:gradle-vagrant-plugin · fixed in 3.0.0
- CVE-2020-27838A flaw was found in keycloak in versions prior to 13.0.0.Maven · org.keycloak:keycloak-core · fixed in 13.0.0
- CVE-2021-22134A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used.Maven · org.elasticsearch:elasticsearch · fixed in 7.11.0
- CVE-2021-21331DataDog API Client contains a Local Information Disclosure VulnerabilityMaven · com.datadoghq:datadog-api-client · fixed in 1.0.0-beta.9
- CVE-2020-1936Stored XSS in Apache AmbariMaven · org.apache.ambari:ambari · fixed in 2.7.4
- CVE-2021-22114Addresses partial fix in CVE-2018-1263.Maven · org.springframework.integration:spring-integration-zip · fixed in 1.0.4
- CVE-2021-25122Apache Tomcat h2c request mix-upMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 10.0.2, 9.0.43, 8.5.63
- CVE-2021-25329Incomplete fix for CVE-2020-9484Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 10.0.2, 9.0.41, 8.5.61 and more
- CVE-2020-27223In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple AcceptMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.37, 10.0.1, 11.0.1
- CVE-2021-20328MongoDB Java driver client-side field level encryption not verifying KMS host nameMaven · org.mongodb:mongo-java-driver, org.mongodb:mongodb-driver +2 · fixed in 3.11.3, 3.12.8, 4.0.6 and more
- CVE-2020-11988Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParseMaven · org.apache.xmlgraphics:xmlgraphics-commons · fixed in 2.6
- CVE-2021-21622Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored crossMaven · io.jenkins.plugins:artifact-repository-parameter · fixed in 1.0.1
- CVE-2021-21620A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims.Maven · org.jenkins-ci.plugins:claim · fixed in 2.18.2
- CVE-2021-21621Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication deMaven · org.jenkins-ci.plugins:support-core · fixed in 2.72.1
- CVE-2021-21619Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerabilitMaven · org.jenkins-ci.plugins:claim · fixed in 2.18.2
- CVE-2021-21617A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply differeMaven · org.jenkins-ci.plugins:configurationslicing · fixed in 1.52
- CVE-2021-21618Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a storeMaven · org.jenkins-ci.plugins:repository-connector · fixed in 2.0.3
- CVE-2021-21616Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS)Maven · org.biouno:uno-choice · fixed in 2.5.3
- CVE-2020-11987Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel.Maven · org.apache.xmlgraphics:batik-svgbrowser · fixed in 1.14
- CVE-2021-22112Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail toMaven · org.springframework.security:spring-security-bom, org.springframework.security:spring-security-web · fixed in 5.4.4, 5.3.8, 5.2.9
- CVE-2020-27782A flaw was found in the Undertow AJP connector.Maven · io.undertow:undertow-core · fixed in 2.1.5, 2.0.33