Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10356A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions alloMaven · org.jenkins-ci.plugins:script-security · fixed in 1.62
- CVE-2019-10357A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obMaven · org.jenkins-ci.plugins.workflow:workflow-cps-global-lib · fixed in 2.15
- CVE-2019-10358Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build Maven · org.jenkins-ci.main:maven-plugin · fixed in 3.4
- CVE-2019-10359A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowedMaven · org.jenkins-ci.plugins.m2release:m2release · fixed in 0.15.0
- CVE-2019-10360A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML anMaven · org.jenkins-ci.plugins.m2release:m2release · fixed in 0.15.0
- CVE-2019-10361Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users witMaven · org.jenkins-ci.plugins.m2release:m2release · fixed in 0.15.0
- CVE-2019-10362Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import Maven · io.jenkins:configuration-as-code · fixed in 1.25
- CVE-2019-10363Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted Maven · io.jenkins:configuration-as-code · fixed in 1.25
- CVE-2019-10364Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.Maven · org.jenkins-ci.plugins:ec2 · fixed in 1.44
- CVE-2019-10365Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspMaven · org.jenkins-ci.plugins:google-kubernetes-engine · fixed in 0.6.3
- CVE-2019-10366Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they coulMaven · org.jenkins-ci.plugins:skytap · fixed in 2.07
- CVE-2019-10343Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configMaven · io.jenkins:configuration-as-code · fixed in 1.25
- CVE-2019-7614A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request.Maven · org.elasticsearch:elasticsearch · fixed in 6.8.2, 7.2.1
- CVE-2019-14439A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.9.2, 2.8.11.4, 2.7.9.6 and more
- CVE-2019-14379SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcacheMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.9.2, 2.8.11.4, 2.7.9.6
- CVE-2019-13990initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job descriptMaven · org.quartz-scheduler:quartz · fixed in 2.3.2
- CVE-2018-11779In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the SMaven · org.apache.storm:storm-kafka, org.apache.storm:storm-kafka-client · fixed in 1.2.3
- CVE-2019-0202The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm.Maven · org.apache.storm:storm-core · fixed in 1.2.3
- CVE-2019-10184undertow before version 2.0.23.Final is vulnerable to an information leak issue.Maven · io.undertow:undertow-servlet · fixed in 2.0.23
- CVE-2019-1010206OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation.Maven · com.github.kevinsawicki:http-request
- CVE-2019-10173It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.Maven · com.thoughtworks.xstream:xstream · fixed in 1.4.11
- CVE-2019-1010241Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format.Maven · org.jenkins-ci.plugins:credentials-binding
- CVE-2019-10352A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.jMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.2, 2.186
- CVE-2019-10353CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.176.2, 2.186
- CVE-2019-10354A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fraMaven · org.jenkins-ci.main:jenkins-core, org.kohsuke.stapler:stapler-parent · fixed in 2.176.2, 2.186, 1.257.1
- CVE-2018-17196In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotenMaven · org.apache.kafka:kafka · fixed in 2.1.1
- CVE-2019-10340A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed uMaven · io.jenkins.docker:docker-plugin · fixed in 1.1.7
- CVE-2019-10341A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with OveralMaven · io.jenkins.docker:docker-plugin · fixed in 1.1.7
- CVE-2019-10342A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with OverallMaven · io.jenkins.docker:docker-plugin · fixed in 1.1.7
- CVE-2019-10346A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrarMaven · io.jenkins.plugins:embeddable-build-status-plugin · fixed in 2.0.2