Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-27582org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 containsMaven · org.mitre:openid-connect-parent
- CVE-2021-20220A flaw was found in Undertow.Maven · io.undertow:undertow-core · fixed in 2.1.6, 2.0.34
- CVE-2021-22113Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassingMaven · org.springframework.cloud:spring-cloud-netflix-zuul · fixed in 2.2.7
- CVE-2020-13697An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1.Maven · org.nanohttpd:nanohttpd-nanolets
- CVE-2021-27568An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4.Maven · net.minidev:json-smart, net.minidev:json-smart-mini · fixed in 1.3.2, 2.4.1, 2.3.1
- CVE-2021-26544Apache Livy (Incubating) is vulnerable to cross site scriptingMaven · org.apache.livy:livy-server · fixed in 0.7.1-incubating
- CVE-2020-12668Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context.Maven · com.hubspot.jinjava:jinjava · fixed in 2.5.4
- CVE-2021-26296Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFacesMaven · org.apache.myfaces.core:myfaces-core-module · fixed in 2.0.25, 2.1.19, 2.2.14 and more
- CVE-2020-28491Denial of Service (DoS)Maven · com.fasterxml.jackson.dataformat:jackson-dataformat-cbor · fixed in 2.11.4, 2.12.1
- CVE-2021-3396OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <Maven · org.opennms.features:org.opennms.features.measurements, org.opennms:opennms +2 · fixed in 27.0.4
- CVE-2021-23339HTTP Request SmugglingMaven · com.typesafe.akka:akka-http-core · fixed in 10.2.4, 10.1.14
- CVE-2020-13949In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentialMaven · org.apache.thrift:libthrift · fixed in 0.14.0
- CVE-2021-21028Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code ExecutionMaven · com.adobe.acs:acs-aem-commons · fixed in 4.10.0
- CVE-2020-10734A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection.Maven · org.keycloak:keycloak-oidc-client-adapter-pom · fixed in 18.0.0
- CVE-2020-1717A flaw was found in Keycloak 7.0.1.Maven · org.keycloak:keycloak-parent
- CVE-2020-7021Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is Maven · org.elasticsearch:elasticsearch · fixed in 6.8.14, 7.10.0
- CVE-2021-0341In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crMaven · com.squareup.okhttp3:okhttp · fixed in 4.9.2
- CVE-2021-21479In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity oMaven · com.sap.scimono:scimono-server · fixed in 0.0.19
- CVE-2020-13947An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp Maven · org.apache.activemq:activemq-parent · fixed in 5.16.1, 5.15.14
- CVE-2021-21290Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesMaven · io.netty:netty, io.netty:netty-codec-http +1 · fixed in 4.1.59.Final
- CVE-2021-23331Insecure Temporary FileMaven · com.squareup:connect
- CVE-2020-17523Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.Maven · org.apache.shiro:shiro-spring, org.apache.shiro:shiro-spring-boot-starter +1 · fixed in 1.7.1
- CVE-2020-17516Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryMaven · org.apache.cassandra:cassandra-all · fixed in 3.0.24, 3.11.10
- CVE-2020-29582In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation.Maven · org.jetbrains.kotlin:kotlin-stdlib · fixed in 1.4.21
- CVE-2021-21043Reflected Cross-site Scripting (XSS) on version-compare and page-compare toolsMaven · com.adobe.acs:acs-aem-commons · fixed in 4.10.0
- CVE-2021-21294Unbounded connection acceptance in http4s-blaze-serverMaven · org.http4s:http4s-blaze-server_2.12, org.http4s:http4s-blaze-server_2.13 · fixed in 0.21.17
- CVE-2021-21293Unbounded connection acceptance leads to file handle exhaustionMaven · org.http4s:blaze-core_2.11, org.http4s:blaze-core_2.12 +1 · fixed in 0.14.15
- CVE-2021-25646Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.Maven · org.apache.druid:druid · fixed in 0.20.1
- CVE-2020-1725A flaw was found in keycloak before version 13.0.0.Maven · org.keycloak:keycloak-parent · fixed in 13.0.0
- CVE-2021-26118Flaw in ActiveMQ Artemis OpenWire supportMaven · org.apache.activemq:artemis-openwire-protocol · fixed in 2.16.0