Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2099Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowingMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.204.2, 2.214
- CVE-2020-1940The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitMaven · org.apache.jackrabbit:oak-core · fixed in 1.24.0, 1.10.8
- CVE-2020-7934In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are alMaven · com.liferay.portal:release.portal.bom · fixed in 7.3.0
- CVE-2020-1933A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0.Maven · org.apache.nifi:nifi · fixed in 1.11.0
- CVE-2020-1928An information disclosure vulnerability was found in Apache NiFi 1.10.0.Maven · org.apache.nifi:nifi-parameter · fixed in 1.11.0
- CVE-2019-10770All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS).Maven · io.ratpack:ratpack-core · fixed in 1.7.6
- CVE-2020-5207Request smuggling is possible in Ktor when both chunked TE and content length specifiedMaven · io.ktor:ktor-client-cio, io.ktor:ktor-server-cio · fixed in 1.3.0
- CVE-2020-7238Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunMaven · io.netty:netty-handler · fixed in 4.1.45
- CVE-2014-4172A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client beMaven · org.jasig.cas:cas-client · fixed in 3.3.2
- CVE-2020-7226CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocatioMaven · org.cryptacular:cryptacular · fixed in 1.1.4, 1.2.4
- CVE-2019-14888A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS.Maven · io.undertow:undertow-core · fixed in 2.0.29.Final
- CVE-2019-17570An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpMaven · org.apache.xmlrpc:xmlrpc
- CVE-2020-5397CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 5.2.3
- CVE-2020-5398RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux ApplicationMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 5.2.3.RELEASE, 5.1.13.RELEASE, 5.0.16.RELEASE
- CVE-2019-17573By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.Maven · org.apache.cxf:apache-cxf, org.apache.cxf:cxf · fixed in 3.2.12, 3.3.5
- CVE-2019-12423Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be usMaven · org.apache.cxf:apache-cxf, org.apache.cxf:cxf · fixed in 3.2.12, 3.3.5
- CVE-2020-1929The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification.Maven · org.apache.beam:beam-sdks-java-io-mongodb · fixed in 2.17.0
- CVE-2015-1811XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.600, 1.596.1
- CVE-2015-1809XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.600, 1.596.1
- CVE-2020-2096Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerabiMaven · org.jenkins-ci.ruby-plugins:gitlab-hook
- CVE-2020-2097Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with OverallMaven · org.jenkins-ci.plugins:sounds · fixed in 0.6
- CVE-2020-2098A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the Maven · org.jenkins-ci.plugins:sounds · fixed in 0.6
- CVE-2020-2094A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to seMaven · org.jenkins-ci.plugins:cloudbees-jenkins-advisor · fixed in 3.0.1
- CVE-2020-2095Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master wMaven · com.redgate.plugins.redgatesqlci:redgate-sql-ci · fixed in 2.0.5
- CVE-2020-2092Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing usMaven · org.jenkins-ci.plugins:robot · fixed in 2.0.1
- CVE-2020-2093A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email wMaven · org.jenkins-ci.plugins:cloudbees-jenkins-advisor · fixed in 3.0.1
- CVE-2020-2090A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specifieMaven · org.jenkins-ci.plugins:ec2 · fixed in 1.48
- CVE-2020-2091A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:ec2 · fixed in 1.48
- CVE-2019-12399When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, anMaven · org.apache.kafka:kafka · fixed in 2.0.2, 2.1.2, 2.2.2 and more
- CVE-2013-6430The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properlMaven · org.springframework:spring-web · fixed in 3.2.2.RELEASE