Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2267A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some meMaven · org.jenkins-ci.plugins:mongodb
- CVE-2020-2268A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadataMaven · org.jenkins-ci.plugins:mongodb
- CVE-2020-2264Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting Maven · org.jenkins-ci.plugins:custom-job-icon
- CVE-2020-2265Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored Maven · org.jenkins-ci.plugins:covcomplplot
- CVE-2020-2262Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (Maven · org.jvnet.hudson.plugins:android-lint
- CVE-2020-2263Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scriptMaven · org.jenkins-ci.plugins:radiatorviewplugin
- CVE-2020-2260A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attackMaven · io.jenkins.plugins:perfecto · fixed in 1.18
- CVE-2020-2261Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to rMaven · io.jenkins.plugins:perfecto · fixed in 1.18
- CVE-2020-2257Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site Maven · org.jenkins-ci.plugins:validating-string-parameter · fixed in 2.5
- CVE-2020-2258Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attMaven · org.jenkins-ci.plugins:cloudbees-jenkins-advisor · fixed in 3.2.1
- CVE-2020-2259Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting Maven · jenkins.ci.plugins.computerqueue:computer-queue-plugin · fixed in 1.6
- CVE-2020-2255A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an atMaven · io.jenkins.blueocean:blueocean · fixed in 1.23.3
- CVE-2020-2256Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, Maven · org.jenkins-ci.plugins:pipeline-maven · fixed in 3.9.3
- CVE-2020-2253Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.Maven · org.jenkins-ci.plugins:email-ext · fixed in 2.76
- CVE-2020-2254Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/ConfigureMaven · io.jenkins.blueocean:blueocean · fixed in 1.23.3
- CVE-2020-2252Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.Maven · org.jenkins-ci.plugins:mailer · fixed in 1.32.1, 1.31.1, 1.29.1
- CVE-2020-11977In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can useMaven · org.apache.syncope:syncope · fixed in 2.1.7
- CVE-2019-0233An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.Maven · org.apache.struts:struts2-core · fixed in 2.5.22
- CVE-2019-0230Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exeMaven · org.apache.struts:struts2-core · fixed in 2.5.22
- CVE-2020-24164A deserialization flaw is present in Taoensso Nippy before 2.14.2.Maven · com.taoensso:nippy · fixed in 2.14.2
- CVE-2020-15171Users with SCRIPT rights can execute arbitrary code in XWikiMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 11.10.5, 12.2.1
- CVE-2020-15170Missing access control in apollo-adminserviceMaven · com.ctrip.framework.apollo:apollo-core · fixed in 1.7.1
- CVE-2020-11998A regression has been introduced in the commit preventing JMX re-bind.Maven · org.apache.activemq:activemq-parent · fixed in 5.15.13
- CVE-2020-13920Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry.Maven · org.apache.activemq:activemq-parent · fixed in 5.15.12
- CVE-2020-23814Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) Maven · com.xuxueli:xxl-job · fixed in 2.3.0
- CVE-2020-23811xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.Maven · com.xuxueli:xxl-job
- CVE-2020-13946In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access Maven · org.apache.cassandra:cassandra-all · fixed in 2.1.12, 2.2.18, 3.0.22 and more
- CVE-2020-2249Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the JenkinMaven · org.jenkins-ci.plugins:tfs
- CVE-2020-2250Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins conMaven · org.jenkins-ci.plugins:soapui-pro-functional-testing · fixed in 1.4
- CVE-2020-2251Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job cMaven · org.jenkins-ci.plugins:soapui-pro-functional-testing · fixed in 1.6