Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-16560A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tesMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-16561Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validaMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-16562Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerMaven · org.jenkins-ci.plugins:buildgraph-view
- CVE-2019-16558Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.Maven · com.inflectra.spiratest.plugins:inflectra-spira-integration · fixed in 3.2.4
- CVE-2019-16559A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform cMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-16556Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Maven · org.jenkins-ci.plugins:rundeck · fixed in 3.6.6
- CVE-2019-16557Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master Maven · com.redgate.plugins.redgatesqlci:redgate-sql-ci · fixed in 2.0.4
- CVE-2019-16554A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to haveMaven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 1.24.2
- CVE-2019-16555A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptiMaven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 1.24.2
- CVE-2019-16552A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to aMaven · com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger · fixed in 2.30.2
- CVE-2019-16553A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evalMaven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 1.24.2
- CVE-2019-16549Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing manMaven · org.jenkins-ci.plugins.m2release:m2release · fixed in 0.16.2
- CVE-2019-16550A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackMaven · org.jenkins-ci.plugins.m2release:m2release · fixed in 0.16.2
- CVE-2019-16551A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-spMaven · com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger · fixed in 2.30.2
- CVE-2014-3652JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.Maven · org.keycloak:keycloak-services · fixed in 1.1.0.Beta1
- CVE-2014-3643jersey: XXE via parameter entities not disabled by the jersey SAX parserMaven · com.sun.jersey:jersey-core · fixed in 1.13
- CVE-2017-18640The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.Maven · org.yaml:snakeyaml · fixed in 1.26
- CVE-2019-19703In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.Maven · io.ktor:ktor-client-core · fixed in 1.3.0
- CVE-2014-3656JBoss KeyCloak: XSS in login-status-iframe.htmlMaven · org.keycloak:keycloak-core · fixed in 1.1.0.Beta1
- CVE-2019-16771Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in ArmeriaMaven · com.linecorp.armeria:armeria · fixed in 0.97.0
- CVE-2012-1592A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execMaven · org.apache.struts:struts2-core · fixed in 2.5.22
- CVE-2019-14910A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS froMaven · org.keycloak:keycloak-parent
- CVE-2019-17555The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep()Maven · org.apache.olingo:odata-client-core · fixed in 4.7.0
- CVE-2019-17556Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classMaven · org.apache.olingo:odata-client-proxy · fixed in 4.7.0
- CVE-2019-17554The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entitMaven · org.apache.olingo:odata-client-core, org.apache.olingo:odata-server-core · fixed in 4.7.0
- CVE-2019-14909A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or vMaven · org.keycloak:keycloak-parent
- CVE-2019-17632In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conteMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.24.v20191120
- CVE-2019-10174A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application clMaven · org.infinispan:infinispan-core · fixed in 8.2.12.Final, 9.4.17.Final
- CVE-2019-16548A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision couldMaven · org.jenkins-ci.plugins:google-compute-engine · fixed in 4.2.0
- CVE-2019-16545Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration formsMaven · org.jenkins-ci.plugins:qmetry-for-jira-test-management · fixed in 1.14.0