Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-1925Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends aMaven · org.apache.olingo:odata-client-core · fixed in 4.7.1
- CVE-2019-20366An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.Maven · org.igniterealtime.openfire:parent · fixed in 4.5.0
- CVE-2019-14820It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be Maven · org.keycloak:keycloak-core · fixed in 8.0.0
- CVE-2019-14837A flaw was found in keycloack before version 8.0.0.Maven · org.keycloak:keycloak-core · fixed in 8.0.0
- CVE-2020-5497The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsaMaven · org.mitre:openid-connect-server
- CVE-2019-20330FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.6.7.4, 2.7.9.7, 2.8.11.5 and more
- CVE-2019-10158A flaw was found in Infinispan through version 9.4.14.Final.Maven · org.infinispan:infinispan-core · fixed in 9.4.15.Final
- CVE-2016-1000027Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untruMaven · org.springframework:spring-web · fixed in 6.0.0
- CVE-2019-17558Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter.Maven · org.apache.solr:solr-core · fixed in 8.4.0
- CVE-2019-6035Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishMaven · com.yahoo.athenz:athenz · fixed in 1.8.25
- CVE-2019-12418When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacMaven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 7.0.99, 8.5.49, 9.0.29
- CVE-2019-17563When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where anMaven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 7.0.99, 8.5.50, 9.0.30
- CVE-2019-17571Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exeMaven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2019-19899Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because Maven · io.pebbletemplates:pebble-project · fixed in 3.1.4
- CVE-2019-16576A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to conMaven · io.alauda.jenkins.plugins:alauda-kubernetes-support
- CVE-2019-16574A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to conneMaven · com.alauda.jenkins.plugins:alauda-devops-pipeline
- CVE-2019-16575A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an atMaven · io.alauda.jenkins.plugins:alauda-kubernetes-support
- CVE-2019-16571A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:rapiddeploy-jenkins
- CVE-2019-16572Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can Maven · org.jenkins-ci.plugins:weibo
- CVE-2019-16573A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attaMaven · com.alauda.jenkins.plugins:alauda-devops-pipeline
- CVE-2019-16569A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified weMaven · org.jenkins-ci.plugins:mantis
- CVE-2019-16570A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specifieMaven · org.jenkins-ci.plugins:rapiddeploy-jenkins
- CVE-2019-16567A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access tMaven · org.jenkins-ci.plugins:teamconcert
- CVE-2019-16568Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configurMaven · hudson.plugins.sctmexecutor:sctmexecutor
- CVE-2019-16565A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-speciMaven · org.jenkins-ci.plugins:teamconcert
- CVE-2019-16566A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an aMaven · org.jenkins-ci.plugins:teamconcert
- CVE-2019-16563Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a storedMaven · tech.andrey.jenkins:mission-control-view
- CVE-2019-16564Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerabiliMaven · com.paul8620.jenkins.plugins:pipeline-aggregator-view · fixed in 1.9
- CVE-2019-16560A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tesMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-16561Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validaMaven · org.jenkins-ci.plugins:websphere-deployer