Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7622HTTP Response SplittingMaven · io.jooby:jooby-netty · fixed in 2.2.1
- CVE-2020-1728A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing gMaven · org.keycloak:keycloak-core
- CVE-2020-1958When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credenMaven · org.apache.druid:druid · fixed in 0.17.1
- CVE-2019-17564Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled.Maven · org.apache.dubbo:dubbo-rpc-http-invoker · fixed in 2.7.5
- CVE-2018-11802In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection.Maven · org.apache.solr:solr-core, org.apache.solr:solr-parent · fixed in 7.7.0, 6.6.6
- CVE-2020-1954Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.Maven · org.apache.cxf:cxf-rt-management · fixed in 3.2.13, 3.3.6
- CVE-2020-10199Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).Maven · org.sonatype.nexus:nexus-extdirect · fixed in 3.21.2
- CVE-2020-10204Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.Maven · org.sonatype.nexus:nexus-core · fixed in 3.21.2
- CVE-2020-10203Sonatype Nexus Repository before 3.21.2 allows XSS.Maven · org.sonatype.nexus:nexus-core · fixed in 3.21.2
- CVE-2020-7009Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create AMaven · org.elasticsearch:elasticsearch · fixed in 6.8.8, 7.6.2
- CVE-2020-11111FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.acMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-11112FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.coMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-11113FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.opMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-7611All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request HeaMaven · io.micronaut:micronaut-http-client · fixed in 1.2.11, 1.3.2
- CVE-2020-5289Read permissions not enforced for client provided filter expressions in Elide http clientMaven · com.yahoo.elide:elide-core · fixed in 4.5.14
- CVE-2016-11023odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection.Maven · org.odata4j:odata4j-core, org.odata4j:odata4j-dist +1
- CVE-2016-11024odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection.Maven · org.odata4j:odata4j-core, org.odata4j:odata4j-dist +1
- CVE-2019-17561The "Apache NetBeans" autoupdate system does not fully validate code signatures.Maven · org.codehaus.mevenide:netbeans
- CVE-2019-17560The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads.Maven · org.codehaus.mevenide:netbeans
- CVE-2020-7599All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File.Maven · com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin, com.gradle.publish:plugin-publish-plugin · fixed in 0.11.0
- CVE-2020-10968FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-10969FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-5280Local file inclusion vulnerability in http4sMaven · org.http4s:http4s-server_2.12 · fixed in 0.18.26, 0.20.20, 0.21.2
- CVE-2020-2171Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:rapiddeploy-jenkins · fixed in 4.2.1
- CVE-2020-2169A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error Maven · org.jenkins-ci.plugins:queue-cleanup · fixed in 1.4
- CVE-2020-2170Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server, resulting iMaven · org.jenkins-ci.plugins:rapiddeploy-jenkins · fixed in 4.2.1
- CVE-2020-2166Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resuMaven · de.taimos:pipeline-aws · fixed in 1.41
- CVE-2020-2167Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resMaven · com.openshift.jenkins:openshift-pipeline · fixed in 1.0.57
- CVE-2020-2168Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types,Maven · org.jenkins-ci.plugins:azure-acs · fixed in 1.0.2
- CVE-2020-2164Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the JenkMaven · org.jenkins-ci.plugins:artifactory · fixed in 3.6.0