Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-11932A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WMaven · pl.droidsonroids.gif:android-gif-drawable · fixed in 1.2.18
- CVE-2019-10212A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.Maven · io.undertow:undertow-core · fixed in 2.0.20
- CVE-2019-17091faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer FacesMaven · org.glassfish:jakarta.faces, org.glassfish:javax.faces · fixed in 2.3.10, 2.2.20
- CVE-2019-0231Apache MINA SSLFilter security IssueMaven · org.apache.mina:mina-core · fixed in 2.0.21, 2.1.1
- CVE-2019-16943A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.1, 2.8.11.5, 2.6.7.3
- CVE-2019-16942A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10.1, 2.8.11.5, 2.6.7.3
- CVE-2019-10202A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7.Maven · org.codehaus.jackson:jackson-mapper-asl
- CVE-2019-10433Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wMaven · io.jenkins.plugins:dingding-notifications · fixed in 2.0.0
- CVE-2019-10434Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulMaven · com.mtvi.plateng.hudson:ldapemail
- CVE-2019-10435Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in Maven · org.jenkins-ci.plugins:vault-scm-plugin
- CVE-2019-10431A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions iMaven · org.jenkins-ci.plugins:script-security · fixed in 1.65
- CVE-2019-10432Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cMaven · org.jenkins-ci.plugins:htmlpublisher · fixed in 1.21
- CVE-2019-16869Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leadsMaven · io.netty:netty, io.netty:netty-all +1 · fixed in 4.1.42.Final
- CVE-2019-10424Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · com.technicolor:eloyente
- CVE-2019-10425Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by userMaven · org.jenkins-ci.plugins:gcal
- CVE-2019-10426Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · net.arangamani.jenkins:gem-publisher
- CVE-2019-10427Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuratMaven · org.jenkins-ci.plugins:aqua-microscanner · fixed in 1.0.8
- CVE-2019-10428Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins confiMaven · org.jenkins-ci.plugins:aqua-security-scanner · fixed in 3.0.18
- CVE-2019-10429Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed byMaven · org.jenkins-ci.plugins:gitlab-logo · fixed in 1.0.4
- CVE-2019-10430Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the JenkinMaven · io.jenkins.plugins:neuvector-vulnerability-scanner · fixed in 1.6
- CVE-2019-10412Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration forMaven · com.inedo.proget:inedo-proget · fixed in 1.3
- CVE-2019-10413Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they cMaven · com.datatheorem.mobileappsecurity.jenkins.plugin:datatheorem-mobile-app-security · fixed in 1.4.0
- CVE-2019-10414Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could Maven · de.wellnerbou.jenkins:git-changelog · fixed in 2.18
- CVE-2019-10415Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins Maven · org.jenkins-ci.plugins:violation-comments-to-gitlab · fixed in 2.29
- CVE-2019-10416Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master whMaven · org.jenkins-ci.plugins:violation-comments-to-gitlab · fixed in 2.29
- CVE-2019-10417Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke aMaven · io.fabric8.pipeline:kubernetes-pipeline-steps
- CVE-2019-10418Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke aMaven · io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps
- CVE-2019-10419Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where theyMaven · org.jenkins-ci.plugins:application-director-plugin
- CVE-2019-10420Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jenkins-ci.plugins:assembla
- CVE-2019-10421Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can bMaven · org.jenkins-ci.plugins:azure-event-grid-notifier