Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-0205In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input dataMaven · org.apache.thrift:libthrift · fixed in 0.13.0
- CVE-2012-2945Hadoop 1.0.3 contains a symlink vulnerability.Maven · org.apache.hadoop:hadoop-main · fixed in 1.0.4
- CVE-2019-18394A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to sendMaven · org.igniterealtime.openfire:parent · fixed in 4.5.0-beta
- CVE-2019-18393PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directMaven · org.igniterealtime.openfire:parent · fixed in 4.5.0-beta
- CVE-2019-12415In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted documMaven · org.apache.poi:poi · fixed in 4.1.1
- CVE-2019-10476Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they coulMaven · org.jenkins-ci.plugins:zulip · fixed in 1.1.1
- CVE-2019-10474A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to tMaven · org.jenkins-ci.plugins:global-post-script
- CVE-2019-10475A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript intoMaven · org.jenkins-ci.plugins:build-metrics
- CVE-2019-10472A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specifieMaven · org.jenkins-ci.plugins:libvirt-slave · fixed in 1.8.6
- CVE-2019-10473A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credMaven · org.jenkins-ci.plugins:libvirt-slave · fixed in 1.8.6
- CVE-2019-10470A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read accMaven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2019-10471A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server Maven · org.jenkins-ci.plugins:libvirt-slave · fixed in 1.8.6
- CVE-2019-10468A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-Maven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2019-10469A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect toMaven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2019-10466An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolvMaven · org.jenkins-ci.plugins.plugin:fireline
- CVE-2019-10467Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wMaven · org.jenkins-ci.plugins:sonar-gerrit · fixed in 2.4.5
- CVE-2019-10464A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using Maven · org.jenkins-ci.plugins:weblogic-deployer-plugin
- CVE-2019-10465A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specifiMaven · org.jenkins-ci.plugins:weblogic-deployer-plugin
- CVE-2019-10462A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connectMaven · org.jenkins-ci.plugins:dynatrace-dashboard · fixed in 2.1.4
- CVE-2019-10463A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to anMaven · org.jenkins-ci.plugins:dynatrace-dashboard · fixed in 2.1.5
- CVE-2019-10460Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins masMaven · org.jenkins-ci.plugins:bitbucket-oauth · fixed in 0.10
- CVE-2019-10461Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the JenMaven · org.jenkins-ci.plugins:dynatrace-dashboard · fixed in 2.1.4
- CVE-2019-10459Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuratiMaven · org.jenkins-ci.plugins:mattermost · fixed in 2.7.1
- CVE-2019-16530Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.Maven · org.sonatype.nexus:nexus-repository · fixed in 2.14.15, 3.19.0
- CVE-2019-17513An issue was discovered in Ratpack before 1.7.5.Maven · io.ratpack:ratpack-core · fixed in 1.7.5
- CVE-2019-11284Reactor Netty authentication leak in redirectsMaven · io.projectreactor.netty:reactor-netty · fixed in 0.8.11
- CVE-2019-13116The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java DeserializatMaven · org.mule.runtime:mule · fixed in 3.8.0
- CVE-2019-10456A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an aMaven · org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic
- CVE-2019-10457A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to coMaven · org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic
- CVE-2019-10458Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers ablMaven · org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline