Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10454A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attackerMaven · org.jenkins-ci.plugins:rundeck · fixed in 3.6.6
- CVE-2019-10455A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL uMaven · org.jenkins-ci.plugins:rundeck · fixed in 3.6.6
- CVE-2019-10453Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:delphix
- CVE-2019-10450Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they canMaven · com.elasticbox.jenkins-ci.plugins:elasticbox
- CVE-2019-10451Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewMaven · com.soasta.jenkins:cloudtest
- CVE-2019-10452Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed bMaven · org.jenkins-ci.plugins:view26
- CVE-2019-10449Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usMaven · org.jenkins-ci.plugins:fortify-on-demand-uploader · fixed in 5.0.0
- CVE-2019-10447Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with EMaven · io.jenkins.plugins:sofy-ai
- CVE-2019-10448Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usMaven · jenkins.xtc:extensivetesting
- CVE-2019-10445A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obMaven · org.jenkins-ci.plugins:google-kubernetes-engine · fixed in 0.7.1
- CVE-2019-10446Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jenkins-ci.plugins:vmanager-plugin · fixed in 2.7.1
- CVE-2019-10442A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:icescrum · fixed in 1.1.6
- CVE-2019-10443Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be vMaven · org.jenkins-ci.plugins:icescrum · fixed in 1.1.5
- CVE-2019-10444Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.Maven · org.jenkins-ci.plugins:bumblebee · fixed in 4.1.4
- CVE-2019-10440Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the Maven · org.jenkins-ci.plugins:neoload-jenkins-plugin · fixed in 2.2.6
- CVE-2019-10441A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specifieMaven · org.jenkins-ci.plugins:icescrum · fixed in 1.1.6
- CVE-2019-10438A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission tMaven · org.jenkins-ci.plugins:crx-content-package-deployer · fixed in 1.9
- CVE-2019-10439A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods alMaven · org.jenkins-ci.plugins:crx-content-package-deployer · fixed in 1.9
- CVE-2019-10436An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs andMaven · org.jenkins-ci.plugins:google-oauth-plugin · fixed in 0.10
- CVE-2019-10437A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to Maven · org.jenkins-ci.plugins:crx-content-package-deployer · fixed in 1.9
- CVE-2019-14832A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured.Maven · org.keycloak:keycloak-model-infinispan, org.keycloak:keycloak-model-jpa · fixed in 7.0.1
- CVE-2019-17195Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crashMaven · com.nimbusds:nimbus-jose-jwt · fixed in 7.9
- CVE-2019-14838A flaw was found in wildfly-core before 7.2.5.GA.Maven · org.wildfly.core:wildfly-host-controller · fixed in 7.2.5.GA
- CVE-2019-17531A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.1, 2.8.11.5, 2.6.7.3
- CVE-2019-17495A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPOMaven · io.springfox:springfox-swagger-ui, org.webjars.npm:swagger-ui +1 · fixed in 2.10.0, 3.23.11
- CVE-2019-17359The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError Maven · org.bouncycastle:bcprov-jdk14 · fixed in 1.64
- CVE-2019-17352In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload aMaven · com.jfinal:jfinal · fixed in 4.5
- CVE-2019-17267A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10, 2.8.11.5
- CVE-2018-11768In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupteMaven · org.apache.hadoop:hadoop-main · fixed in 2.8.5, 2.9.2, 3.1.1
- CVE-2019-16891Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.Maven · com.liferay.portal:release.portal.bom · fixed in 7.1.1