Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-1758A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using tMaven · org.keycloak:keycloak-parent · fixed in 10.0.0
- CVE-2020-5408Dictionary attack with Spring Security queryable text encryptorMaven · org.springframework.security:spring-security-core · fixed in 5.3.2, 5.2.4, 5.1.10 and more
- CVE-2020-1941In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.Maven · org.apache.activemq:activemq-web-console · fixed in 5.15.12
- CVE-2020-11972Apache Camel RabbitMQ enables Java deserialization by default.Maven · org.apache.camel:camel-rabbitmq · fixed in 2.25.1, 3.2.0
- CVE-2020-11973Apache Camel Netty enables Java deserialization by default.Maven · org.apache.camel:camel-netty · fixed in 3.2.0
- CVE-2020-11971Apache Camel's JMX is vulnerable to Rebind Flaw.Maven · org.apache.camel:camel, org.apache.camel:camel-core +1 · fixed in 3.2.0
- CVE-2019-17572In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../Maven · org.apache.rocketmq:rocketmq-broker · fixed in 4.6.1
- CVE-2020-1960A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.Maven · org.apache.flink:flink-core · fixed in 1.9.3, 1.10.1
- CVE-2020-1945Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir forMaven · org.apache.ant:ant · fixed in 1.9.15, 1.10.8
- CVE-2020-1714A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.Maven · org.keycloak:keycloak-common, org.keycloak:keycloak-core · fixed in 11.0.0
- CVE-2020-5407Signature Wrapping Vulnerability with spring-security-saml2-service-providerMaven · org.springframework.security:spring-security-core · fixed in 5.2.4, 5.3.2
- CVE-2020-1718A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0.Maven · org.keycloak:keycloak-parent · fixed in 8.0.0
- CVE-2020-1724A flaw was found in Keycloak in versions before 9.0.2.Maven · org.keycloak:keycloak-core · fixed in 9.0.2
- CVE-2020-7647All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to DiMaven · io.jooby:jooby, org.jooby:jooby · fixed in 2.8.2
- CVE-2020-12760An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7.Maven · org.opennms.core:org.opennms.core.daemon · fixed in 26.0.1
- CVE-2020-1698A flaw was found in keycloak in versions before 9.0.0.Maven · org.keycloak:keycloak-core · fixed in 9.0.0
- CVE-2019-10170A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy.Maven · org.keycloak:keycloak-core · fixed in 8.0.0
- CVE-2019-10169A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy.Maven · org.keycloak:keycloak-authz-client · fixed in 8.0.0
- CVE-2020-11050Improper Validation of Certificate with Host Mismatch in Java-WebSocketMaven · org.java-websocket:java-websocket · fixed in 1.5.0
- CVE-2020-10693A flaw was found in Hibernate Validator version 6.1.2.Final.Maven · org.hibernate.validator:hibernate-validator, org.hibernate:hibernate-validator · fixed in 6.1.5.Final, 6.0.20.Final
- CVE-2020-2189Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulMaven · io.jenkins.plugins:scm-filter-jervis · fixed in 0.3
- CVE-2020-2187Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabMaven · org.jenkins-ci.plugins:ec2 · fixed in 1.50.2
- CVE-2020-2188A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access toMaven · org.jenkins-ci.plugins:ec2 · fixed in 1.50.2
- CVE-2020-2185Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks.Maven · org.jenkins-ci.plugins:ec2 · fixed in 1.50.2
- CVE-2020-2186A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances.Maven · org.jenkins-ci.plugins:ec2 · fixed in 1.50.2
- CVE-2020-2182Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some Maven · org.jenkins-ci.plugins:credentials-binding · fixed in 1.23
- CVE-2020-2183Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they havMaven · org.jenkins-ci.plugins:copyartifact · fixed in 1.44
- CVE-2020-2184A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to conMaven · org.jenkins-ci.plugins:cvs · fixed in 2.16
- CVE-2020-2181Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build conMaven · org.jenkins-ci.plugins:credentials-binding · fixed in 1.23
- CVE-2020-10686A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself.Maven · org.keycloak:keycloak-core · fixed in 9.0.2