Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2297Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controlleMaven · com.hoiio.jenkins:sms
- CVE-2020-2294Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers withMaven · com.barchart.jenkins:maven-release-cascade
- CVE-2020-2295A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascadMaven · com.barchart.jenkins:maven-release-cascade
- CVE-2020-2291Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins conMaven · org.jenkins-ci.plugins:couchdb-statistics · fixed in 0.4
- CVE-2020-2292Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (Maven · org.jenkins-ci.plugins:release · fixed in 2.11
- CVE-2020-2293Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.Maven · org.jenkins-ci.plugins:persona
- CVE-2020-2289Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-siteMaven · org.biouno:uno-choice · fixed in 2.5
- CVE-2020-2290Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resMaven · org.biouno:uno-choice · fixed in 2.5
- CVE-2020-2287Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web Maven · org.jenkins-ci.plugins:audit-trail · fixed in 3.7
- CVE-2020-2288In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to Maven · org.jenkins-ci.plugins:audit-trail · fixed in 3.7
- CVE-2020-2286Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is cMaven · org.jenkins-ci.plugins:role-strategy · fixed in 3.1
- CVE-2020-25803Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.Maven · org.craftercms:crafter-studio · fixed in 3.0.27, 3.1.7
- CVE-2020-25802Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.Maven · org.craftercms:crafter-studio · fixed in 3.0.27, 3.1.7
- CVE-2020-25644A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session.Maven · org.wildfly.openssl:wildfly-openssl-natives-parent · fixed in 1.1.3.Final
- CVE-2020-7709Prototype PollutionMaven · org.webjars.npm:json-pointer · fixed in 0.6.1
- CVE-2020-15232XML External Entity attack in mapfish-printMaven · org.mapfish.print:print-lib, org.mapfish.print:print-servlet +1 · fixed in 3.24
- CVE-2020-15231Cross-site scripting attack in mapfish-printMaven · org.mapfish.print:print-lib, org.mapfish.print:print-servlet +1 · fixed in 3.24
- CVE-2020-9491In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by prMaven · org.apache.nifi:nifi · fixed in 1.12.0-RC1
- CVE-2020-13940In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trustMaven · org.apache.nifi:nifi · fixed in 1.12.0-RC1
- CVE-2020-9487In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a reqMaven · org.apache.nifi:nifi · fixed in 1.12.0-RC1
- CVE-2020-9486In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values.Maven · org.apache.nifi:nifi-stateless · fixed in 1.12.0-RC1
- CVE-2020-11979As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was alMaven · org.apache.ant:ant · fixed in 1.10.9
- CVE-2020-19676Nacos 1.1.4 is affected by: Incorrect Access Control.Maven · com.alibaba.nacos:nacos-common · fixed in 1.2.0
- CVE-2020-13951Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 5.1.0
- CVE-2018-11765In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication wMaven · org.apache.hadoop:hadoop-main · fixed in 3.0.1, 2.9.3, 2.8.6
- CVE-2020-13953In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being ruMaven · org.apache.tapestry:tapestry-core · fixed in 5.6.0
- CVE-2020-15840In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom +1 · fixed in 7.4.0, 7.1.3, 7.0.10.fp93 and more
- CVE-2020-2284Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:liquibase-runner · fixed in 1.4.7
- CVE-2020-2285A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate cMaven · org.jenkins-ci.plugins:liquibase-runner · fixed in 1.4.8
- CVE-2020-2282Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read Maven · org.jenkins-ci.plugins:implied-labels · fixed in 0.7