Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-35491FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.coMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.8
- CVE-2020-26258Server-Side Forgery Request can be activated unmarshalling with XStreamMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.15
- CVE-2020-26259XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.15
- CVE-2020-35476A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter.Maven · net.opentsdb:opentsdb
- CVE-2020-10770A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter Maven · org.keycloak:keycloak-core · fixed in 13.0.0
- CVE-2020-35460common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writinMaven · net.sf.mpxj:mpxj · fixed in 8.3.5
- CVE-2020-17530Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.Maven · org.apache.struts:struts2-core · fixed in 2.5.26
- CVE-2020-8908Temp directory permission issue in GuavaMaven · com.google.guava:guava · fixed in 32.0.0-android
- CVE-2020-8920Overoptimization leads to private information leak in GerritMaven · com.google.gerrit:gerrit-plugin-api · fixed in 2.14.22, 2.15.21, 2.16.25 and more
- CVE-2020-16971Azure SDK for Java Security Feature Bypass VulnerabilityMaven · com.azure:azure-core-amqp, com.microsoft.azure:azure-eventhubs · fixed in 1.6.0, 3.2.1
- CVE-2020-26234Disabled Hostname Verification in OpenCastMaven · org.opencastproject:opencast-kernel · fixed in 7.9, 8.9
- CVE-2020-27822A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final.Maven · org.wildfly:wildfly-parent · fixed in 21.0.2.Final, 22.0.0.Beta1
- CVE-2020-17531Deserialization flaw in EOL Tapestry 4.Maven · org.apache.tapestry:tapestry-project · fixed in 5.0.1
- CVE-2020-17521Apache Groovy provides extension methods to aid with creating temporary directories.Maven · org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all · fixed in 2.4.21, 2.5.14, 3.0.7
- CVE-2020-17527Apache Tomcat: Request header mix-up between HTTP/2 streamsMaven · org.apache.tomcat:tomcat-coyote · fixed in 10.0.0-M10, 9.0.40, 8.5.60
- CVE-2020-28923An issue was discovered in Play Framework 2.8.0 through 2.8.4.Maven · com.typesafe.play:play · fixed in 2.8.5
- CVE-2020-25649A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.6.7.4, 2.9.10.7, 2.10.5.1
- CVE-2020-2323Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read perMaven · io.jenkins.plugins:chaos-monkey · fixed in 0.4.1
- CVE-2020-2324Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:cvs · fixed in 2.17
- CVE-2020-2320Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.Maven · io.jenkins.plugin-management:plugin-management-parent-pom · fixed in 2.2.0
- CVE-2020-2321A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or Maven · org.jenkins-ci.plugins:shelve-project-plugin · fixed in 3.1
- CVE-2020-2322Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/ReMaven · io.jenkins.plugins:chaos-monkey · fixed in 0.4
- CVE-2020-25711A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operatioMaven · org.infinispan:infinispan-core · fixed in 11.0.6.Final
- CVE-2020-13956Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the liMaven · org.apache.httpcomponents:httpclient · fixed in 4.5.13, 5.0.3
- CVE-2020-25638A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.Maven · org.hibernate:hibernate-core · fixed in 5.4.24.Final, 5.3.20.Final
- CVE-2020-27218In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request boMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.35.v20201120
- CVE-2017-15680In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative daMaven · org.craftercms:crafter-core · fixed in 3.0.1
- CVE-2017-15681In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files froMaven · org.craftercms:crafter-studio · fixed in 3.0.2
- CVE-2017-15682In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS Maven · org.craftercms:crafter-core · fixed in 3.0.1
- CVE-2017-15683In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrievaMaven · org.craftercms:crafter-core · fixed in 3.0.1