Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10387A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users withMaven · com.xebialabs.xlt.ci:xltestview-plugin
- CVE-2019-10388A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to havMaven · org.jenkins-ci.plugins:relution-publisher
- CVE-2019-10389A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiaMaven · org.jenkins-ci.plugins:relution-publisher
- CVE-2019-10371A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attMaven · org.jenkins-ci.plugins:gitlab-oauth · fixed in 1.5
- CVE-2019-10372An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirMaven · org.jenkins-ci.plugins:gitlab-oauth · fixed in 1.5
- CVE-2019-10373A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipelMaven · org.jenkins-ci.plugins:build-pipeline-plugin
- CVE-2019-10374A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions aMaven · org.jenkins-ci.plugins:pegdown-formatter
- CVE-2019-10375An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins toMaven · hudson.plugins.filesystem_scm:filesystem_scm
- CVE-2019-10376A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML aMaven · org.jenkins-ci.plugins:jenkinswalldisplay
- CVE-2019-10377A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any usMaven · net.hurstfrost.jenkins:avatar
- CVE-2019-10378Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they caMaven · org.jenkins-ci.plugins:testlink
- CVE-2019-10379Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the JeMaven · org.jenkins-ci.plugins:gcm-notification
- CVE-2019-10380Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attacMaven · org.jenkins-ci.plugins:simple-travis-runner
- CVE-2019-10381Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jenkins-ci.plugins:codefresh
- CVE-2019-10382Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jenkins-ci.plugins:labmanager
- CVE-2019-10385Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be vieweMaven · org.jenkins-ci.plugins:eggplant-plugin
- CVE-2019-10386A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection aMaven · com.xebialabs.xlt.ci:xltestview-plugin
- CVE-2019-10367Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some valMaven · io.jenkins:configuration-as-code · fixed in 1.27
- CVE-2019-10368A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection anMaven · org.jenkins-ci.plugins:jclouds-jenkins · fixed in 2.15
- CVE-2019-10369A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DMaven · org.jenkins-ci.plugins:jclouds-jenkins · fixed in 2.15
- CVE-2019-10370Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, poMaven · org.jenkins-ci.plugins:mask-passwords · fixed in 2.13.0
- CVE-2019-10088A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21.Maven · org.apache.tika:tika-core · fixed in 1.22
- CVE-2019-10094A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Maven · org.apache.tika:tika-core · fixed in 1.22
- CVE-2019-10093In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very lMaven · org.apache.tika:tika-parsers · fixed in 1.22
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whiMaven · org.apache.solr:solr-core · fixed in 8.2.0
- CVE-2018-10899A flaw was found in Jolokia versions from 1.2 to before 1.6.1.Maven · org.jolokia:jolokia-core · fixed in 1.6.1
- CVE-2015-7559It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class.Maven · org.apache.activemq:activemq-client · fixed in 5.14.5
- CVE-2019-10344Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/ReadMaven · io.jenkins:configuration-as-code · fixed in 1.25
- CVE-2019-10345Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted foMaven · io.jenkins:configuration-as-code · fixed in 1.25
- CVE-2019-10355A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers toMaven · org.jenkins-ci.plugins:script-security · fixed in 1.62