Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2217Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form vMaven · org.jenkins-ci.plugins:compatibility-action-storage
- CVE-2020-2218Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master whMaven · org.jenkins-ci.plugins:hp-quality-center
- CVE-2020-2214Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worksMaven · com.vrondakis.zap:zap-pipeline · fixed in 1.10
- CVE-2020-2215A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to Maven · org.jenkins-ci.plugins:zephyr-for-jira-test-management
- CVE-2020-2211Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrMaven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2020-2212Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master whMaven · io.jenkins.plugins:github-coverage-reporter
- CVE-2020-2213Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files oMaven · org.jenkins-ci.plugins:whitesource · fixed in 20.8.1
- CVE-2020-2209Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it cMaven · org.jenkins-ci.plugins:testcomplete · fixed in 2.5.2
- CVE-2020-2210Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuraMaven · org.jenkins-ci.plugins:stashbranchparameter
- CVE-2020-2207Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflMaven · org.jenkins-ci.plugins:vncviewer · fixed in 1.8
- CVE-2020-2208Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewedMaven · org.jenkins-ci.plugins:slack-uploader
- CVE-2020-2204A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect toMaven · org.jenkins-ci.plugins:fortify-on-demand-uploader · fixed in 6.0.1
- CVE-2020-2205Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a storeMaven · org.jenkins-ci.plugins:vncrecorder · fixed in 1.35
- CVE-2020-2206Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a rMaven · org.jenkins-ci.plugins:vncrecorder · fixed in 1.35
- CVE-2020-2202A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read accMaven · org.jenkins-ci.plugins:fortify-on-demand-uploader · fixed in 6.0.1
- CVE-2020-2203A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globallyMaven · org.jenkins-ci.plugins:fortify-on-demand-uploader · fixed in 6.0.0
- CVE-2020-2201Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in aMaven · org.jenkins-ci.plugins:sonargraph-integration · fixed in 3.0.1
- CVE-2020-15087Privilege escalation in PrestoMaven · io.prestosql:presto-server · fixed in 337
- CVE-2020-11996A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could tMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat · fixed in 10.0.0-M5, 9.0.35, 8.5.55
- CVE-2020-10727A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plainMaven · org.apache.activemq:artemis-commons · fixed in 2.13.0
- CVE-2020-9480In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) vMaven · org.apache.spark:spark-parent_2.11 · fixed in 2.4.6
- CVE-2020-11989Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication Maven · org.apache.shiro:shiro-core · fixed in 1.5.3
- CVE-2020-10740A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise ApMaven · org.wildfly:wildfly-parent · fixed in 20.0.0.Final
- CVE-2020-9495Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection.Maven · org.apache.archiva:archiva · fixed in 2.2.5
- CVE-2020-14195FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurityMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.5
- CVE-2020-9296Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators.Maven · com.netflix.conductor:conductor-core · fixed in 2.25.4
- CVE-2020-11969If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is openMaven · org.apache.tomee:tomee · fixed in 8.0.2, 7.1.3, 7.0.8 and more
- CVE-2020-14060FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apacMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.5
- CVE-2020-14061FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.5
- CVE-2020-14062FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.aMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.5