Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2284Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:liquibase-runner · fixed in 1.4.7
- CVE-2020-2285A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate cMaven · org.jenkins-ci.plugins:liquibase-runner · fixed in 1.4.8
- CVE-2020-2282Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read Maven · org.jenkins-ci.plugins:implied-labels · fixed in 0.7
- CVE-2020-2283Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulneMaven · org.jenkins-ci.plugins:liquibase-runner · fixed in 1.4.6
- CVE-2020-2280A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.Maven · org.jvnet.hudson.plugins:warnings · fixed in 5.0.2
- CVE-2020-2281A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreservMaven · org.6wind.jenkins:lockable-resources · fixed in 2.9
- CVE-2020-2279A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripMaven · org.jenkins-ci.plugins:script-security · fixed in 1.75, 1.66.5
- CVE-2020-10687A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possMaven · io.undertow:undertow-core · fixed in 2.2.0.Final
- CVE-2020-10714A flaw was found in WildFly Elytron version 1.11.3.Final and before.Maven · org.wildfly.security:wildfly-elytron · fixed in 1.11.4
- CVE-2020-15839Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/forMaven · com.liferay.portal:release.dxp.bom · fixed in 7.1.10.fp18, 7.2.10.fp6
- CVE-2020-5421RFD Protection Bypass via jsessionidMaven · org.springframework:spring-framework-bom · fixed in 5.2.9, 5.1.18, 5.0.19 and more
- CVE-2020-25633A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final.Maven · org.jboss.resteasy:resteasy-client, org.jboss.resteasy:resteasy-client-microprofile · fixed in 4.5.7.Final, 3.14.0.Final
- CVE-2020-24750FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.hMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.6.7.5, 2.9.10.6
- CVE-2020-14338A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of WildflMaven · xerces:xercesimpl · fixed in 2.12.0.sp3
- CVE-2020-1694A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience.Maven · org.keycloak:keycloak-parent · fixed in 10.0.0
- CVE-2020-10748A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances.Maven · org.keycloak:keycloak-parent · fixed in 10.0.2
- CVE-2020-13928Apache Atlas before 2.1.0 contain a XSS vulnerability.Maven · org.apache.atlas:apache-atlas · fixed in 2.1.0
- CVE-2020-1748A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypMaven · org.wildfly.security:wildfly-elytron · fixed in 1.6.8
- CVE-2020-10758A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified Maven · org.keycloak:keycloak-parent · fixed in 11.0.1
- CVE-2020-2278Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permisMaven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2020-2276Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/ConfMaven · org.jvnet.hudson.plugins:selection-tasks-plugin
- CVE-2020-2277Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.Maven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2020-2273A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-spMaven · org.jenkins-ci.plugins:elastest
- CVE-2020-2274Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller Maven · org.jenkins-ci.plugins:elastest
- CVE-2020-2275Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workMaven · org.jvnet.hudson.plugins:copy-data-to-workspace-plugin
- CVE-2020-2271Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scriptiMaven · org.jvnet.hudson.plugins:locked-files-report
- CVE-2020-2272A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacMaven · org.jenkins-ci.plugins:elastest
- CVE-2020-2269Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-sMaven · org.jenkins-ci.plugins:chosen-views-tabbar
- CVE-2020-2270Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site sMaven · org.jvnet.hudson.plugins:clearcase-release
- CVE-2020-2266Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-sitMaven · org.jenkins-ci.plugins:description-column-plugin