Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23900OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input.Maven · com.mikesamuel:json-sanitizer · fixed in 1.2.2
- CVE-2021-23899OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.Maven · com.mikesamuel:json-sanitizer · fixed in 1.2.2
- CVE-2020-17534There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject Maven · org.netbeans.html:pom · fixed in 1.7.1
- CVE-2020-11995Apache Dubbo default deserialization protocol Hessian2 cause CREMaven · org.apache.dubbo:dubbo-parent · fixed in 2.7.8, 2.6.9
- CVE-2020-13922Apache DolphinScheduler (incubating) Permission vulnerabilityMaven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 1.3.2
- CVE-2020-25476Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to CaMaven · com.liferay.portal:release.portal.bom
- CVE-2020-36179FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apacMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8, 2.6.7.5
- CVE-2020-36180FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.coMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8, 2.6.7.5
- CVE-2020-36182FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8, 2.6.7.5
- CVE-2020-36183FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.orMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8, 2.6.7.5
- CVE-2020-36184FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8
- CVE-2020-36185FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8
- CVE-2020-36186FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8
- CVE-2020-36187FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8
- CVE-2020-36188FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8, 2.6.7.5
- CVE-2020-36189FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8, 2.6.7.5
- CVE-2020-36181FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8, 2.6.7.5
- CVE-2021-21234Directory TraversalMaven · eu.hinsch:spring-boot-actuator-logview · fixed in 0.2.13
- CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST APIMaven · org.apache.flink:flink-runtime_2.11, org.apache.flink:flink-runtime_2.12 · fixed in 1.11.3
- CVE-2020-17518Apache Flink directory traversal attack: remote file writing through the REST APIMaven · org.apache.flink:flink-runtime · fixed in 1.11.3
- CVE-2020-13654XWiki Platform before 12.8 mishandles escaping in the property displayer.Maven · org.xwiki.platform:xwiki-platform-web · fixed in 12.8
- CVE-2020-35774server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS Maven · com.twitter:twitter-server_2.12 · fixed in 20.12.0
- CVE-2020-17533Apache Accumulo Improper Handling of Insufficient PermissionsMaven · org.apache.accumulo:accumulo-master · fixed in 1.10.1, 2.0.1
- CVE-2020-29204XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/Maven · com.xuxueli:xxl-job-core · fixed in 2.3.0
- CVE-2020-35728FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wlMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8
- CVE-2020-26282Template Injection in BrowserUp ProxyMaven · com.browserup:browserup-proxy · fixed in 2.1.2
- CVE-2020-28052An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.Maven · org.bouncycastle:bcprov-ext-jdk15on, org.bouncycastle:bcprov-ext-jdk16 +5 · fixed in 1.67
- CVE-2020-11974In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.Maven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 1.3.0
- CVE-2020-13931If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the Maven · org.apache.tomee:apache-tomee · fixed in 8.0.4, 7.1.4, 7.0.9
- CVE-2020-35490FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.coMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8