Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-16545Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration formsMaven · org.jenkins-ci.plugins:qmetry-for-jira-test-management · fixed in 1.14.0
- CVE-2019-16546Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling Maven · org.jenkins-ci.plugins:google-compute-engine · fixed in 4.2.0
- CVE-2019-16547Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/ReMaven · org.jenkins-ci.plugins:google-compute-engine · fixed in 4.2.0
- CVE-2019-16543Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where Maven · com.inflectra.spiratest.plugins:inflectra-spira-integration · fixed in 3.2.3
- CVE-2019-16544Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins mastMaven · org.jenkins-ci.plugins:qmetry-for-jira-test-management · fixed in 1.13
- CVE-2019-16541Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to sMaven · org.jenkins-ci.plugins:jira · fixed in 3.0.11
- CVE-2019-16542Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins mastMaven · org.jenkins-ci.plugins:anchore-container-scanner · fixed in 1.0.20
- CVE-2019-16538A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions iMaven · org.jenkins-ci.plugins:script-security · fixed in 1.68
- CVE-2019-16539A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bMaven · org.jenkins-ci.plugins:support-core · fixed in 2.64
- CVE-2019-16540A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitMaven · org.jenkins-ci.plugins:support-core · fixed in 2.64
- CVE-2019-10083When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the Maven · org.apache.nifi:nifi, org.apache.nifi:nifi-web-api · fixed in 1.10.0
- CVE-2019-12421When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the auMaven · org.apache.nifi:nifi-web-api, org.apache.nifi:nifi-web-security · fixed in 1.10.0
- CVE-2019-10080The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file.Maven · org.apache.nifi:nifi, org.apache.nifi:nifi-security · fixed in 1.10.0
- CVE-2019-12422Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.Maven · org.apache.shiro:shiro-core · fixed in 1.4.2
- CVE-2012-4441Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTMMaven · org.jenkins-ci.plugins:ci-game · fixed in 1.19
- CVE-2012-4440Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTMMaven · org.jenkins-ci.plugins:violations · fixed in 0.7.11
- CVE-2012-4439Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTMMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.466.2, 1.482
- CVE-2019-12409The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default sMaven · org.apache.solr:solr-core · fixed in 8.3.0
- CVE-2012-4438Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data aMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.466.2, 1.482
- CVE-2019-10070Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionalityMaven · org.apache.atlas:apache-atlas · fixed in 0.8.4, 1.2.0
- CVE-2019-10172A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries.Maven · org.codehaus.jackson:jackson-mapper-asl
- CVE-2019-19040KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{Maven · org.kairosdb:kairosdb · fixed in 1.3.0
- CVE-2014-3655JBoss KeyCloak is vulnerable to soft token deletion via CSRFMaven · org.keycloak:keycloak-services · fixed in 1.0.2.Final
- CVE-2014-3599HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasyMaven · org.hornetq.rest:hornetq-rest · fixed in 2.5.0.Beta1
- CVE-2019-10219A vulnerability was found in Hibernate-Validator.Maven · org.hibernate.validator:hibernate-validator, org.hibernate:hibernate-validator · fixed in 6.1.0.Alpha6, 6.0.18.Final
- CVE-2019-12419Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service.Maven · org.apache.cxf:cxf · fixed in 3.2.11, 3.3.4
- CVE-2019-12406Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.Maven · org.apache.cxf:apache-cxf, org.apache.cxf:cxf · fixed in 3.2.11, 3.3.4
- CVE-2019-17598An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23.Maven · com.typesafe.play:play-ws_2.12 · fixed in 2.6.24
- CVE-2011-3923Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary Maven · org.apache.struts:struts2-core · fixed in 2.3.1.2
- CVE-2019-7619Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service.Maven · org.elasticsearch:elasticsearch · fixed in 6.8.4, 7.4.0