Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10396Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitaMaven · org.jenkins-ci.plugins:dashboard-view · fixed in 2.12
- CVE-2019-10397Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuratioMaven · org.jenkins-ci.plugins:aqua-serverless · fixed in 1.0.5
- CVE-2019-10398Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where thMaven · org.jenkins-ci.plugins:beaker-builder · fixed in 1.10
- CVE-2019-10399A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property exprMaven · org.jenkins-ci.plugins:script-security · fixed in 1.63
- CVE-2019-10400A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment andMaven · org.jenkins-ci.plugins:script-security · fixed in 1.63
- CVE-2019-11777In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the resMaven · org.eclipse.paho:org.eclipse.paho.client.mqttv3 · fixed in 1.2.1
- CVE-2019-12401Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a.Maven · org.apache.solr:solr-core · fixed in 5.0.0
- CVE-2019-16147Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.Maven · com.liferay:com.liferay.journal.taglib · fixed in 3.0.4
- CVE-2019-16148Sakai through 12.6 allows XSS via a chat user name.Maven · org.sakaiproject:chat-base
- CVE-2019-10753In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to versiMaven · com.diffplug.spotless:spotless-eclipse-cdt, com.diffplug.spotless:spotless-eclipse-groovy +1 · fixed in 9.4.4, 3.0.1, 3.9.6
- CVE-2019-5475The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnMaven · org.sonatype.nexus.plugins:nexus-yum-repository-plugin · fixed in 2.14.14
- CVE-2019-15630Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before AuguMaven · org.mule.runtime:mule
- CVE-2019-12402The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speciMaven · io.github.1tchy.java9modular.org.apache.commons:commons-compress, org.apache.commons:commons-compress · fixed in 1.19
- CVE-2019-10384Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.3, 2.192
- CVE-2019-10390A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a GroovyMaven · com.splunk.splunkins:splunk-devops · fixed in 1.8.0
- CVE-2019-10391Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuratiMaven · com.hcl.security:ibm-application-security · fixed in 1.2.5
- CVE-2019-10383A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.3, 2.192
- CVE-2019-13237In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access serveMaven · org.opencms:opencms-core · fixed in 11.0.1
- CVE-2019-13236In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.Maven · org.opencms:opencms-core · fixed in 11.0.1
- CVE-2019-13235In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.Maven · org.opencms:opencms-core · fixed in 11.0.1
- CVE-2019-13234In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.Maven · org.opencms:opencms-core · fixed in 11.0.1
- CVE-2019-15563Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.Maven · org.ohdsi:webapi · fixed in 2.7.2
- CVE-2019-12400In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a sMaven · org.apache.santuario:xmlsec · fixed in 2.1.4
- CVE-2019-15488Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.Maven · org.igniterealtime.openfire:xmppserver · fixed in 4.4.1
- CVE-2019-15477Jooby before 1.6.4 has XSS via the default error handler.Maven · org.jooby:jooby · fixed in 1.6.4
- CVE-2019-10086In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to accessMaven · commons-beanutils:commons-beanutils · fixed in 1.9.4
- CVE-2019-10201It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures.Maven · org.keycloak:keycloak-core · fixed in 7.0.0
- CVE-2019-10199It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests.Maven · org.keycloak:keycloak-core · fixed in 7.0.0
- CVE-2019-12397Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue.Maven · org.apache.ranger:ranger · fixed in 2.0.0
- CVE-2019-10099Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.Maven · org.apache.spark:spark-core_2.11 · fixed in 2.3.3