Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2247Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:klocwork · fixed in 2020.3.1
- CVE-2020-2248Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.Maven · org.jenkins-ci.plugins:jsgames
- CVE-2020-2245Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:valgrind
- CVE-2020-2246Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vMaven · org.jenkins-ci.plugins:valgrind
- CVE-2020-2242A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an Maven · org.jenkins-ci.plugins:database · fixed in 1.7
- CVE-2020-2243Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scriptingMaven · org.jenkins-ci.plugins:vmanager-plugin · fixed in 3.0.5
- CVE-2020-2244Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-sMaven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 1.27.1
- CVE-2020-2240A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripMaven · org.jenkins-ci.plugins:database · fixed in 1.7
- CVE-2020-2241A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specMaven · org.jenkins-ci.plugins:database · fixed in 1.7
- CVE-2020-2238Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stoMaven · org.jenkins-ci.tools:git-parameter · fixed in 0.9.13
- CVE-2020-2239Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins coMaven · org.jenkins-ci.plugins:parameterized-remote-trigger · fixed in 3.1.4
- CVE-2020-24554The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allowsMaven · com.liferay.portal:release.portal.bom · fixed in 7.3.3
- CVE-2020-7712Command InjectionMaven · org.webjars.npm:json
- CVE-2020-25020MPXJ through 8.1.3 allows XXE attacks.Maven · net.sf.mpxj:mpxj · fixed in 8.1.4
- CVE-2020-9298The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requesMaven · com.netflix.spinnaker.orca:orca-core · fixed in 8.7.0
- CVE-2020-15777An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise.Maven · com.gradle:gradle-enterprise-maven-extension · fixed in 1.6
- CVE-2020-24616FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteroMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.6
- CVE-2020-7019In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security.Maven · org.elasticsearch:elasticsearch · fixed in 7.9.0, 6.8.12
- CVE-2020-12480In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameMaven · com.typesafe.play:play_2.12 · fixed in 2.7.5, 2.8.2
- CVE-2020-13933Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.Maven · org.apache.shiro:shiro-core · fixed in 1.6.0
- CVE-2020-13941Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0.Maven · org.apache.solr:solr-parent · fixed in 8.6.0
- CVE-2020-2235A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connectMaven · org.jenkins-ci.plugins:pipeline-maven · fixed in 3.8.3
- CVE-2020-2236Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSMaven · com.axis.system.jenkins.plugins.downstream:yet-another-build-visualizer · fixed in 1.12
- CVE-2020-2237A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a projeMaven · org.jenkins-ci.plugins:flaky-test-handler · fixed in 1.1.0
- CVE-2020-2233A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerateMaven · org.jenkins-ci.plugins:pipeline-maven · fixed in 3.8.3
- CVE-2020-2234A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect tMaven · org.jenkins-ci.plugins:pipeline-maven · fixed in 3.8.3
- CVE-2020-2231Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.235.4, 2.252
- CVE-2020-2232Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuratMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.74
- CVE-2020-2229Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.235.4, 2.252
- CVE-2020-2230Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-siteMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.235.4, 2.252