Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10422Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by userMaven · org.ukiuni.callotherjenkins:call-remote-job-plugin
- CVE-2019-10423Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · com.villagechief.codescan.jenkins:codescan
- CVE-2019-10401In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, rMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.4, 2.197
- CVE-2019-10402In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a storeMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.4, 2.197
- CVE-2019-10403Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a storedMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.4, 2.197
- CVE-2019-10404Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a storedMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.4, 2.197
- CVE-2019-10405Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attacMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.4, 2.197
- CVE-2019-10406Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resultiMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.4, 2.197
- CVE-2019-10407Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive vMaven · hudson.plugins:project-inheritance · fixed in 19.08.02
- CVE-2019-10408A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project geneMaven · hudson.plugins:project-inheritance · fixed in 19.08.2
- CVE-2019-10409A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to triggerMaven · hudson.plugins:project-inheritance · fixed in 19.08.02
- CVE-2019-10410Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by Maven · org.jenkins-ci.plugins:log-parser · fixed in 2.1
- CVE-2019-10411Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuratMaven · com.inedo.proget:inedo-proget · fixed in 2.5.0
- CVE-2019-10755The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes tMaven · org.pac4j:pac4j-saml · fixed in 3.8.2
- CVE-2019-10754Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generaMaven · org.apereo.cas:cas-server-core-services-api, org.apereo.cas:cas-server-core-services-authentication +4 · fixed in 6.1.0-RC5
- CVE-2019-12407On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Maven · org.apache.jspwiki:jspwiki-main, org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M5
- CVE-2019-10090On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Maven · org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M5
- CVE-2019-12404On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Maven · org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M5
- CVE-2019-10089On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Maven · org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M5
- CVE-2019-10087On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Maven · org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M5
- CVE-2019-16370The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a diffeMaven · org.gradle:gradle-core · fixed in 6.0
- CVE-2019-10071The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparisMaven · org.apache.tapestry:tapestry-core · fixed in 5.4.5
- CVE-2019-0207Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter Maven · org.apache.tapestry:tapestry-core · fixed in 5.4.5
- CVE-2019-0195Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded.Maven · org.apache.tapestry:tapestry-core · fixed in 5.4.5
- CVE-2019-16335A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10, 2.8.11.5, 2.6.7.3
- CVE-2019-14540A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.10, 2.8.11.5, 2.6.7.3
- CVE-2019-10392Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git lsMaven · org.jenkins-ci.plugins:git-client · fixed in 2.8.5
- CVE-2019-10393A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expMaven · org.jenkins-ci.plugins:script-security · fixed in 1.63
- CVE-2019-10394A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property exprMaven · org.jenkins-ci.plugins:script-security · fixed in 1.63
- CVE-2019-10395Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerabilMaven · org.jenkins-ci.plugins:build-environment · fixed in 1.7