Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2165Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, Maven · org.jenkins-ci.plugins:artifactory · fixed in 3.6.1
- CVE-2020-2162Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a bMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.228
- CVE-2020-2163Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.228
- CVE-2020-2160Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLsMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.204.6, 2.228
- CVE-2020-2161Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label exprMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.228
- CVE-2020-1957Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication Maven · org.apache.shiro:shiro-core · fixed in 1.5.2
- CVE-2020-1744A flaw was found in keycloak before version 9.0.1.Maven · org.keycloak:keycloak-core · fixed in 9.0.1
- CVE-2020-1951A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.Maven · org.apache.tika:tika · fixed in 1.24
- CVE-2020-1950A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.Maven · org.apache.tika:tika · fixed in 1.24
- CVE-2020-7961Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web serMaven · com.liferay.portal:com.liferay.portal.kernel · fixed in 4.35.3
- CVE-2019-20526Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.Maven · org.igniterealtime.openfire:parent · fixed in 4.4.2
- CVE-2019-20525Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.Maven · org.igniterealtime.openfire:parent · fixed in 4.4.2
- CVE-2019-12416we got reports for 2 injection attacks against the DeltaSpike windowhandler.js.Maven · org.apache.deltaspike:deltaspike · fixed in 1.9.4
- CVE-2019-20527Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.Maven · org.igniterealtime.openfire:parent · fixed in 4.4.2
- CVE-2020-10672FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.arMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4
- CVE-2020-10673FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.coMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4, 2.6.7.4
- CVE-2019-20528Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.Maven · org.igniterealtime.openfire:xmppserver · fixed in 4.4.2
- CVE-2019-19135In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.OMaven · org.eclipse.milo:sdk-client · fixed in 0.3.6
- CVE-2019-10091When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entriesMaven · org.apache.geode:geode-core · fixed in 1.10.0
- CVE-2020-10591An issue was discovered in Walmart Labs Concord before 1.44.0.Maven · com.walmartlabs.concord:concord-common · fixed in 1.44.0
- CVE-2020-1953Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAMLMaven · org.apache.commons:commons-configuration2 · fixed in 2.7
- CVE-2020-10544An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11.Maven · org.primefaces:primefaces · fixed in 8.0
- CVE-2019-11343Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.Maven · org.torpedoquery:org.torpedoquery · fixed in 2.5.3
- CVE-2020-6858Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection.Maven · com.hotels.styx:styx-api · fixed in 1.0.0-rc1
- CVE-2020-1947In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputsMaven · org.apache.shardingsphere:shardingsphere · fixed in 4.0.1
- CVE-2011-2487The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a BlMaven · org.apache.ws.security:wss4j, wss4j:wss4j · fixed in 1.6.5
- CVE-2012-1094JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mMaven · org.jboss.as:jboss-as-server · fixed in 7.1.1.Final
- CVE-2020-2158Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rMaven · org.jenkins-ci.plugins:literate
- CVE-2020-2159Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins mastMaven · io.jenkins.plugins:cryptomove
- CVE-2020-2155Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuratiMaven · org.jenkins-ci.plugins:openshift-deployer