Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2156Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially rMaven · com.openmake:deployhub
- CVE-2020-2157Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentialMaven · org.jenkins-ci.plugins:skytap
- CVE-2020-2153Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resultMaven · org.jenkins-ci.plugins:backlog · fixed in 2.5
- CVE-2020-2154Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the JeMaven · org.jenkins-ci.plugins:zephyr-for-jira-test-management
- CVE-2020-2151Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration formMaven · org.jenkins-ci.plugins:quality-gates
- CVE-2020-2152Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, reMaven · org.jvnet.hudson.plugins:svn-release-mgr
- CVE-2020-2148A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-sMaven · fr.edf.jenkins.plugins:mac · fixed in 1.2.0
- CVE-2020-2149Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuraMaven · org.jenkins-ci.plugins:repository-connector · fixed in 2.0.0
- CVE-2020-2150Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuratMaven · org.jenkins-ci.plugins:sonar-quality-gates
- CVE-2020-2146Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middlMaven · fr.edf.jenkins.plugins:mac · fixed in 1.2.0
- CVE-2020-2147A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH Maven · fr.edf.jenkins.plugins:mac · fixed in 1.2.0
- CVE-2020-2144Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:rundeck · fixed in 3.6.7
- CVE-2020-2145Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file systeMaven · org.jenkins-ci.plugins:zephyr-enterprise-test-management · fixed in 1.10
- CVE-2020-2141A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in PeMaven · org.jenkins-ci.plugins:p4 · fixed in 1.10.11
- CVE-2020-2142A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.Maven · org.jenkins-ci.plugins:p4 · fixed in 1.10.11
- CVE-2020-2143Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, pMaven · org.jenkins-ci.plugins:logstash · fixed in 2.3.2
- CVE-2020-2139An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report fileMaven · org.jenkins-ci.plugins:cobertura · fixed in 1.16
- CVE-2020-2140Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflMaven · org.jenkins-ci.plugins:audit-trail · fixed in 3.3
- CVE-2020-2136Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulMaven · org.jenkins-ci.plugins:git · fixed in 4.2.1
- CVE-2020-2137Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploMaven · org.jenkins-ci.plugins:timestamper · fixed in 1.11.2
- CVE-2020-2138Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:cobertura · fixed in 1.16
- CVE-2020-2134Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted coMaven · org.jenkins-ci.plugins:script-security · fixed in 1.7.1
- CVE-2020-2135Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that impMaven · org.jenkins-ci.plugins:script-security · fixed in 1.71
- CVE-2020-5405Directory Traversal with spring-cloud-config-serverMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 2.1.7, 2.2.2
- CVE-2020-5403DoS Via Malformed URL with Reactor Netty HTTP ServerMaven · io.projectreactor.netty:reactor-netty-http · fixed in 0.9.5
- CVE-2020-5404Authentication Leak On Redirect With Reactor Netty HttpClientMaven · io.projectreactor.netty:reactor-netty-http · fixed in 0.9.5, 0.8.16
- CVE-2019-14893A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserializatMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10
- CVE-2019-14892A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserializationMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.6.7.3, 2.8.11.5, 2.9.10
- CVE-2020-1731A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random adminMaven · org.keycloak:keycloak-core · fixed in 8.0.2
- CVE-2020-9546FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.haMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4