Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-14062FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.aMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.5
- CVE-2020-11980In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files.Maven · org.apache.karaf.management:org.apache.karaf.management.server · fixed in 4.2.9
- CVE-2020-5411Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"Maven · org.springframework.batch:spring-batch-core · fixed in 4.2.3
- CVE-2020-10705A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may caMaven · io.undertow:undertow-core · fixed in 2.1.1.Final
- CVE-2020-13444Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitizeMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp92, 7.1.10.fp19, 7.2.10.fp7 and more
- CVE-2020-13445In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API dMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.0.10.fp92, 7.1.10.fp18, 7.2.10.fp6 and more
- CVE-2020-13973OWASP json-sanitizer before 1.2.1 allows XSS.Maven · com.mikesamuel:json-sanitizer · fixed in 1.2.1
- CVE-2020-11975Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could executMaven · org.apache.unomi:unomi · fixed in 1.5.4
- CVE-2020-13692PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.Maven · org.postgresql:postgresql · fixed in 42.2.13
- CVE-2020-7014The fix for CVE-2020-7009 was found to be incomplete.Maven · org.elasticsearch:elasticsearch · fixed in 6.8.8, 7.6.2
- CVE-2020-1963Apache Ignite uses H2 database to build SQL distributed execution engine.Maven · org.apache.ignite:ignite-core · fixed in 2.8.1
- CVE-2020-2200Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validatioMaven · org.jenkins-ci.plugins:play-autotest-plugin
- CVE-2020-2197Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance ProMaven · hudson.plugins:project-inheritance
- CVE-2020-2198Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting Maven · hudson.plugins:project-inheritance
- CVE-2020-2199Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form valiMaven · org.jenkins-ci.plugins:svn-partial-release-mgr
- CVE-2020-2195Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripMaven · org.jenkins-ci.plugins:compact-columns · fixed in 1.12
- CVE-2020-2196Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrativeMaven · org.jenkins-ci.plugins:selenium
- CVE-2020-2193Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-siteMaven · io.jenkins.plugins:echarts-api · fixed in 4.7.0-4
- CVE-2020-2194Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored crosMaven · io.jenkins.plugins:echarts-api · fixed in 4.7.0-4
- CVE-2020-2190Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script AppMaven · org.jenkins-ci.plugins:script-security · fixed in 1.73
- CVE-2020-2191Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and remoMaven · org.jenkins-ci.plugins:swarm · fixed in 3.21
- CVE-2020-2192A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add Maven · org.jenkins-ci.plugins:swarm · fixed in 3.21
- CVE-2020-5410Directory Traversal with spring-cloud-config-serverMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 2.1.9, 2.2.3
- CVE-2020-10719A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes.Maven · io.undertow:undertow-core · fixed in 2.1.1.Final
- CVE-2020-1956Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, aMaven · org.apache.kylin:kylin-core-common · fixed in 2.6.6, 3.0.2
- CVE-2018-21234Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.Maven · org.jodd:jodd-json · fixed in 5.0.4
- CVE-2020-9484When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is ableMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 10.0.0-M5, 9.0.35, 8.5.55 and more
- CVE-2020-13226WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this Maven · org.wso2.am:am-parent
- CVE-2020-1695A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an impropeMaven · org.jboss.resteasy:resteasy-client · fixed in 4.6.0, 3.12.0
- CVE-2020-7656jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.Maven · org.webjars.npm:jquery · fixed in 1.9.0