Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2308A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod Maven · org.csanchez.jenkins.plugins:kubernetes · fixed in 1.27.4, 1.26.5, 1.25.4.1 and more
- CVE-2020-2309A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enuMaven · org.csanchez.jenkins.plugins:kubernetes · fixed in 1.27.4, 1.26.5, 1.25.4.1 and more
- CVE-2020-2305Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:mercurial · fixed in 2.12, 2.10.1, 2.9.1 and more
- CVE-2020-2306A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of naMaven · org.jenkins-ci.plugins:mercurial · fixed in 2.12, 2.10.1, 2.9.1 and more
- CVE-2020-2303A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connectionMaven · org.jenkins-ci.plugins:active-directory · fixed in 2.20
- CVE-2020-2304Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:subversion · fixed in 2.13.2
- CVE-2020-2301Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication Maven · org.jenkins-ci.plugins:active-directory · fixed in 2.20, 2.16.1
- CVE-2020-2302A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the dMaven · org.jenkins-ci.plugins:active-directory · fixed in 2.20
- CVE-2020-2299Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.Maven · org.jenkins-ci.plugins:active-directory · fixed in 2.20, 2.16.1
- CVE-2020-2300Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackersMaven · org.jenkins-ci.plugins:active-directory · fixed in 2.20, 2.16.1
- CVE-2020-26939In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponentMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-ext-jdk15on +6 · fixed in 1.0.2, 1.61
- CVE-2020-25689A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating nMaven · org.wildfly:wildfly-dist · fixed in 21.0.1
- CVE-2020-27216In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sysMaven · org.eclipse.jetty:jetty-webapp, org.mortbay.jetty:jetty-webapp · fixed in 9.4.33.v20201020, 10.0.0.beta3, 11.0.0.beta3 and more
- CVE-2020-10721A flaw was found in the fabric8-maven-plugin 4.0.0 and later.Maven · io.fabric8:fabric8-maven-plugin
- CVE-2020-7020Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used.Maven · org.elasticsearch:elasticsearch · fixed in 6.8.13, 7.9.2
- CVE-2018-11764Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0.Maven · org.apache.hadoop:hadoop-main · fixed in 3.0.1
- CVE-2020-13937Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3Maven · org.apache.kylin:kylin · fixed in 3.1.1, 4.0.0-beta
- CVE-2020-8929Ciphertext integrity weakness in TinkMaven · com.google.crypto.tink:tink · fixed in 1.5.0
- CVE-2020-15252RCE in XWikiMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 11.10.6, 12.5
- CVE-2020-27178Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google AuthenMaven · org.apereo.cas:cas-server-support-otp-mfa-core, org.apereo.cas:cas-server-webapp · fixed in 5.3.16, 6.1.7.2, 6.2.4
- CVE-2019-17640In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, Maven · io.vertx:vertx-web · fixed in 3.9.4
- CVE-2020-7744Information ExposureMaven · com.mintegral.msdk:alphab
- CVE-2020-13957Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for Maven · org.apache.solr:solr-core, org.apache.solr:solr-parent +1 · fixed in 8.6.3
- CVE-2020-15250Information disclosure in JUnit4Maven · junit:junit · fixed in 4.13.1
- CVE-2020-13943If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nuMaven · org.apache.tomcat:tomcat-coyote · fixed in 10.0.0-M8, 9.0.38, 8.5.58
- CVE-2020-26945MyBatis before 3.5.6 mishandles deserialization of object streams.Maven · org.mybatis:mybatis · fixed in 3.5.6
- CVE-2020-13955HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-miMaven · org.apache.calcite:calcite-core, org.apache.calcite:calcite-druid +1 · fixed in 1.26.0
- CVE-2020-2298Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:nerrvana-plugin
- CVE-2020-2296A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objMaven · org.jenkins-ci.plugins:shared-objects
- CVE-2020-2297Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controlleMaven · com.hoiio.jenkins:sms