Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-11976By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates.Maven · org.apache.wicket:wicket-core · fixed in 7.17.0, 8.9.0, 9.0.0
- CVE-2020-5412Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboardMaven · org.springframework.cloud:spring-cloud-netflix · fixed in 2.2.4, 2.1.6
- CVE-2020-13921**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.Maven · org.apache.skywalking:oap-server · fixed in 8.1.0
- CVE-2020-5413Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"Maven · org.springframework.integration:spring-integration-core · fixed in 4.3.23, 5.3.2, 5.1.12 and more
- CVE-2020-16164An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28.Maven · net.ripe.rpki:rpki-validator-3 · fixed in 3.2-2020.10.28.23.06
- CVE-2020-14297A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumMaven · org.jboss:jboss-ejb-client · fixed in 4.0.34.Final
- CVE-2020-13932In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit Maven · org.apache.activemq:apache-artemis · fixed in 2.14.0
- CVE-2020-15842Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-miMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp90, 7.1.10.fp17, 7.2.10.fp5 and more
- CVE-2020-15841Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely testMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp89, 7.1.10.fp17, 7.2.10.fp4 and more
- CVE-2020-15813Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers.Maven · org.graylog:graylog-parent · fixed in 3.3.3
- CVE-2020-2227Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-siteMaven · org.jenkins-ci.plugins:deployer-framework · fixed in 1.3
- CVE-2020-2228Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalatiMaven · org.jenkins-ci.plugins:gitlab-oauth · fixed in 1.6
- CVE-2020-2225Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multipleMaven · org.jenkins-ci.plugins:matrix-project · fixed in 1.17
- CVE-2020-2226Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored Maven · org.jenkins-ci.plugins:matrix-auth · fixed in 2.6.2
- CVE-2020-2223Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in tMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.235.2, 2.245
- CVE-2020-2224Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a singleMaven · org.jenkins-ci.plugins:matrix-project · fixed in 1.17
- CVE-2020-2220Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.235.2, 2.245
- CVE-2020-2221Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resultingMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.235.2, 2.245
- CVE-2020-2222Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting inMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.235.2, 2.245
- CVE-2020-13935The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.Maven · org.apache.tomcat.embed:tomcat-embed-websocket, org.apache.tomcat:tomcat +1 · fixed in 7.0.105, 8.5.57, 9.0.37 and more
- CVE-2020-13934An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 procesMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-coyote · fixed in 10.0.0-M6, 9.0.36, 8.5.56
- CVE-2020-1948This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower.Maven · org.apache.dubbo:dubbo, org.apache.dubbo:dubbo-common · fixed in 2.7.7
- CVE-2020-13926Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configuraMaven · org.apache.kylin:kylin-server-base · fixed in 3.1.0
- CVE-2020-13925Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the seMaven · org.apache.kylin:kylin-server-base · fixed in 3.1.0
- CVE-2019-17638In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produceMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.30.v20200611
- CVE-2020-7692Improper AuthorizationMaven · com.google.oauth-client:google-oauth-client · fixed in 1.31.0
- CVE-2020-11994Server-Side Template Injection and arbitrary file disclosure on Camel templating componentsMaven · org.apache.camel:camel-robotframework · fixed in 3.4.0
- CVE-2019-14900A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.Maven · org.hibernate:hibernate-core · fixed in 5.3.18, 5.4.18, 5.5.0.Beta1
- CVE-2020-2219Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stoMaven · org.jenkins-ci.plugins:link-column
- CVE-2020-2216A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission tMaven · org.jenkins-ci.plugins:zephyr-for-jira-test-management