Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-5428Possibility of SQL Injection in Spring Cloud Task Execution Sorting QueryMaven · org.springframework.cloud:spring-cloud-task-dependencies · fixed in 2.2.5
- CVE-2021-26117ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bindMaven · org.apache.activemq:activemq-parent, org.apache.activemq:apache-artemis · fixed in 5.16.1, 5.15.14, 2.16.0
- CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to Maven · org.apache.hadoop:hadoop-common · fixed in 3.2.2, 3.1.4, 2.10.1
- CVE-2021-21615Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-cMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.3, 2.276
- CVE-2020-17532Apache ServiceComb Yaml remote deserialization vulnerabilityMaven · org.apache.servicecomb:java-chassis · fixed in 1.3.2, 2.1.5
- CVE-2021-23901An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParserMaven · org.apache.nutch:nutch · fixed in 1.18
- CVE-2020-23262An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.Maven · net.mingsoft:ms-mcms · fixed in 5.1
- CVE-2020-8570Kubernetes Java client libraries unvalidated path traversal in Copy implementationMaven · io.kubernetes:client-java · fixed in 9.0.2, 10.0.1
- CVE-2020-28452Cross-site Request Forgery (CSRF)Maven · com.softwaremill.akka-http-session:core_2.12 · fixed in 0.6.1
- CVE-2020-35217Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification.Maven · io.vertx:vertx-web · fixed in 4.0.0-milestone5
- CVE-2021-3137XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.Maven · org.xwiki.commons:xwiki-commons · fixed in 12.10.3
- CVE-2021-20190A flaw was found in jackson-databind before 2.9.10.7.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.7, 2.6.7.5
- CVE-2020-27219In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe Maven · org.eclipse.hawkbit:hawkbit-parent · fixed in 0.3.0M7
- CVE-2021-22132Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API.Maven · org.elasticsearch:elasticsearch · fixed in 7.10.2
- CVE-2021-23926XMLBeans XML Entity ExpansionMaven · org.apache.xmlbeans:xmlbeans · fixed in 3.0.0
- CVE-2021-24122Apache Tomcat information disclosureMaven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 10.0.0-M10, 9.0.40, 8.5.60 and more
- CVE-2021-21613Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability eMaven · io.jenkins.plugins:tics · fixed in 2020.3.0.7
- CVE-2021-21614Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller Maven · org.jenkins-ci.plugins:bumblebee · fixed in 4.1.6
- CVE-2021-21612Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controMaven · de.tracetronic.jenkins.plugins:ecutest · fixed in 2.24
- CVE-2021-21610Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup pMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21611Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resultingMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21609Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21607Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attacMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21608Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSSMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.275
- CVE-2021-21605Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21606Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existeMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21604Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject craftedMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21602Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.263.2, 2.275
- CVE-2021-21603Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.275
- CVE-2021-23900OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input.Maven · com.mikesamuel:json-sanitizer · fixed in 1.2.2