Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-15684Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operaMaven · org.craftercms:crafter-studio · fixed in 3.0.2
- CVE-2017-15685Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE).Maven · org.craftercms:crafter-studio · fixed in 3.0.2
- CVE-2017-15686Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.Maven · org.craftercms:crafter-studio · fixed in 3.0.2
- CVE-2020-7780Cross-site Request Forgery (CSRF)Maven · com.softwaremill.akka-http-session:core_2.11, com.softwaremill.akka-http-session:core_2.12 +1 · fixed in 0.5.11
- CVE-2020-26238Critical vulnerability found in cron-utilsMaven · com.cronutils:cron-utils · fixed in 9.1.3
- CVE-2020-25640A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection errMaven · org.wildfly:wildfly-parent · fixed in 21.0.0.Final
- CVE-2020-13942Remote Code Execution in Apache UnomiMaven · org.apache.unomi:unomi · fixed in 1.5.2
- CVE-2020-10776A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter.Maven · org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services · fixed in 12.0.0
- CVE-2020-14389It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account Maven · org.keycloak:keycloak-core · fixed in 12.0.0
- CVE-2020-26217Remote Code Execution in XStreamMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.14-java7
- CVE-2020-8897Robustness weakness in AWS KMS and Encryption SDKsMaven · com.amazonaws:aws-encryption-sdk-java · fixed in 2.0.0
- CVE-2020-27217In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices.Maven · org.eclipse.hono:hono-core · fixed in 1.4.3
- CVE-2020-13954Apache CXF Reflected XSS in the services listing page via the styleSheetPathMaven · org.apache.cxf:apache-cxf, org.apache.cxf:cxf · fixed in 3.3.8, 3.4.1
- CVE-2019-17566Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes.Maven · org.apache.xmlgraphics:batik · fixed in 1.13
- CVE-2020-14366A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resourcesMaven · org.keycloak:keycloak-parent · fixed in 12.0.0
- CVE-2020-26882In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.Maven · com.typesafe.play:play · fixed in 2.7.6, 2.8.3
- CVE-2020-27196An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2.Maven · com.typesafe.play:play, com.typesafe.play:play-java · fixed in 2.7.6, 2.8.3
- CVE-2020-26883In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.Maven · com.typesafe.play:play, com.typesafe.play:play-java · fixed in 2.7.6, 2.8.3
- CVE-2020-17510Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.Maven · org.apache.shiro:shiro-spring · fixed in 1.7.0
- CVE-2020-2318Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins coMaven · org.jenkins-ci.plugins:mailcommander
- CVE-2020-2319Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controMaven · org.jenkins-ci.plugins:labmanager
- CVE-2020-2316Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-siMaven · org.jvnet.hudson.plugins:analysis-core
- CVE-2020-2317Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSMaven · org.jvnet.hudson.plugins:findbugs
- CVE-2020-2314Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where iMaven · com.rapid7:jenkinsci-appspider-plugin · fixed in 1.0.13
- CVE-2020-2315Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:visualworks-store · fixed in 1.1.4
- CVE-2020-2312Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs.Maven · org.jenkins-ci.plugins:sqlplus-script-runner · fixed in 2.0.13
- CVE-2020-2313A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credMaven · org.jenkins-ci.plugins:azure-keyvault · fixed in 2.1
- CVE-2020-2310Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDMaven · org.jenkins-ci.plugins:ansible · fixed in 1.1
- CVE-2020-2311A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replaMaven · io.jenkins.plugins:aws-global-configuration · fixed in 1.6
- CVE-2020-2307Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variableMaven · org.csanchez.jenkins.plugins:kubernetes · fixed in 1.27.4, 1.26.5, 1.25.4.1 and more