Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-10686A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself.Maven · org.keycloak:keycloak-core · fixed in 9.0.2
- CVE-2020-12642An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal.Maven · com.epam.reportportal:service-api · fixed in 4.3.12, 5.1.1
- CVE-2020-1961Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior toMaven · org.apache.syncope:syncope-core · fixed in 2.0.15, 2.1.6
- CVE-2019-17557It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters.Maven · org.apache.syncope.client:syncope-client-enduser · fixed in 2.0.15, 2.1.6
- CVE-2020-1959A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions,Maven · org.apache.syncope:syncope-core · fixed in 2.1.6
- CVE-2020-10683dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks.Maven · dom4j:dom4j, org.dom4j:dom4j · fixed in 2.0.3, 2.1.3
- CVE-2020-11009IDOR can reveal execution data and logs to unauthorized user in RundeckMaven · org.rundeck:rundeck · fixed in 3.2.6
- CVE-2020-11022jQuery has a potential XSS vulnerabilityMaven · org.webjars.npm:jquery · fixed in 3.5.0
- CVE-2020-11023Potential XSS vulnerability in jQueryMaven · org.webjars.npm:jquery · fixed in 3.5.0
- CVE-2020-9482If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates theMaven · org.apache.nifi.registry:nifi-registry-web-api · fixed in 0.7.0
- CVE-2020-1745A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.Maven · io.undertow:undertow-core · fixed in 2.0.30
- CVE-2020-1952An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2.Maven · org.apache.iotdb:iotdb-parent · fixed in 0.9.2
- CVE-2020-9488Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.Maven · org.apache.logging.log4j:log4j, org.apache.logging.log4j:log4j-core · fixed in 2.13.2, 2.12.3, 2.3.2
- CVE-2020-9489A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser.Maven · org.apache.tika:tika · fixed in 1.24.1
- CVE-2020-1757A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unMaven · io.undertow:undertow-core · fixed in 2.1.0
- CVE-2020-11007Negative charge in shopping cart possible in ShopizerMaven · com.shopizer:sm-core-model · fixed in 2.11.0
- CVE-2020-1964It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML pMaven · org.apache.heron:heron-simulator · fixed in 0.20.3-incubating
- CVE-2020-2179Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in Maven · org.jenkins-ci.plugins:yaml-axis · fixed in 0.2.1
- CVE-2020-2180Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a Maven · io.jenkins.plugins:aws-sam · fixed in 1.2.3
- CVE-2020-2177Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed byMaven · org.fedoraproject.jenkins.plugins:copr · fixed in 0.6.1
- CVE-2020-2178Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · com.parasoft:parasoft-findings · fixed in 10.4.4
- CVE-2020-11002Remote Code Execution (RCE) vulnerability in dropwizard-validationMaven · io.dropwizard:dropwizard-validation · fixed in 1.3.21, 2.0.3
- CVE-2020-11620FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.coMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-11619FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springfraMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-11612The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream.Maven · io.netty:netty-handler · fixed in 4.1.46
- CVE-2020-2175Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stoMaven · org.jenkins-ci.plugins:fitnesse · fixed in 1.32
- CVE-2020-2176Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango serviceMaven · it.infuse.jenkins:usemango-runner · fixed in 1.5
- CVE-2020-2173Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, rMaven · org.jenkins-ci.plugins:gatling · fixed in 1.3.0
- CVE-2020-2174Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a Maven · br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin · fixed in 0.3.20
- CVE-2020-2172Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · io.jenkins.plugins:code-coverage-api · fixed in 1.1.5