Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-9547FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4, 2.8.11.6, 2.7.9.7
- CVE-2020-9548FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteroMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.4, 2.8.11.6, 2.7.9.7
- CVE-2020-9447There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality.Maven · com.googlecode.gwtupload:gwtupload
- CVE-2015-2992Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.Maven · org.apache.struts:struts2-core · fixed in 2.3.20
- CVE-2020-1938When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.31, 8.5.51, 7.0.100
- CVE-2020-1935In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsinMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat · fixed in 7.0.100, 8.5.51, 9.0.31
- CVE-2019-17569The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression.Maven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat · fixed in 7.0.100, 8.5.51, 9.0.31
- CVE-2020-1937Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database quMaven · org.apache.kylin:kylin-server-base · fixed in 2.6.5, 3.0.1
- CVE-2020-5245Remote Code Execution (RCE) vulnerability in dropwizard-validationMaven · io.dropwizard:dropwizard-validation · fixed in 1.3.19, 2.0.2
- CVE-2012-0785Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.447, 1.424.2
- CVE-2019-10797Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.Maven · org.wso2.transport.http:org.wso2.transport.http.netty · fixed in 6.3.1
- CVE-2020-8441JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function.Maven · org.jyaml:jyaml
- CVE-2020-2133Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed bMaven · com.applatix.jenkins:applatix
- CVE-2020-2130Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it cMaven · org.jenkins-ci.plugins:harvest
- CVE-2020-2131Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viMaven · org.jenkins-ci.plugins:harvest
- CVE-2020-2132Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master wheMaven · com.parasoft:environment-manager · fixed in 2.15
- CVE-2020-2128Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where itMaven · com.catalogic.ecxjenkins:catalogic-ecx
- CVE-2020-2129Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it Maven · com.mobileenerlytics.eagle.tester:eagle-tester
- CVE-2020-2125Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the JenkinsMaven · ru.yandex.jenkins.plugins.debuilder:debian-package-builder
- CVE-2020-2126Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be vMaven · com.dubture.jenkins:digitalocean-plugin · fixed in 1.2.0
- CVE-2020-2127Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the JenMaven · rpd:bmc-rpd
- CVE-2020-2123Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rMaven · org.jenkins-ci.plugins:radargun · fixed in 1.8
- CVE-2020-2124Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins mastMaven · com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter
- CVE-2020-2121Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary typesMaven · org.jenkins-ci.plugins:google-kubernetes-engine · fixed in 0.8.1
- CVE-2020-2122Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored crMaven · org.jenkins-ci.plugins:brakeman · fixed in 0.13
- CVE-2020-2118A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with OveralMaven · org.jenkins-ci.plugins:pipeline-build-step · fixed in 1.0.5
- CVE-2020-2119Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, pMaven · org.jenkins-ci.plugins:azure-ad · fixed in 1.2.0
- CVE-2020-2120Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:fitnesse · fixed in 1.31
- CVE-2020-2116A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to anMaven · org.jenkins-ci.plugins:pipeline-githubnotify-step · fixed in 1.0.5
- CVE-2020-2117A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to Maven · org.jenkins-ci.plugins:pipeline-githubnotify-step · fixed in 1.0.5