Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10347Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the masMaven · javagh.jenkins:mashup-portlets-plugin · fixed in 1.1.0
- CVE-2019-10348Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with ExteMaven · org.jenkins-ci.plugins:gogs-webhook · fixed in 1.0.15
- CVE-2019-10349A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jMaven · org.jenkins-ci.plugins:depgraph-view · fixed in 0.14
- CVE-2019-10350Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usersMaven · org.jenkins-ci.plugins:port-allocator
- CVE-2019-10351Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users witMaven · com.brianfromoregon:caliper-ci
- CVE-2018-11307An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.7.9.4, 2.8.11.2, 2.9.6
- CVE-2019-9827Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitraMaven · io.hawt:hawtio-core · fixed in 2.5.0
- CVE-2019-11272PlaintextPasswordEncoder authenticates encoded passwords that are nullMaven · org.springframework.security:spring-security-cas, org.springframework.security:spring-security-core · fixed in 4.2.13.RELEASE, 4.2.13
- CVE-2019-12384FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.9.1, 2.8.11.4, 2.7.9.6 and more
- CVE-2019-10072The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions…Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.20, 8.5.41
- CVE-2017-15694When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions canMaven · org.apache.geode:geode-core · fixed in 1.9.0
- CVE-2018-15890An issue was discovered in EthereumJ 1.8.2.Maven · org.ethereum:ethereumj-core
- CVE-2019-12814A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.9.1, 2.8.11.4, 2.7.9.6 and more
- CVE-2019-5442XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amountsMaven · ro.pippo:pippo-jaxb
- CVE-2019-11269Open Redirector in spring-security-oauth2Maven · org.springframework.security.oauth:spring-security-oauth · fixed in 2.0.18.RELEASE, 2.1.5.RELEASE, 2.2.5.RELEASE and more
- CVE-2019-3875A vulnerability was found in keycloak before 6.0.2.Maven · org.keycloak:keycloak-core
- CVE-2019-3888A vulnerability was found in Undertow web server before 2.0.21.Maven · io.undertow:undertow-core · fixed in 2.0.21
- CVE-2019-10337An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content oMaven · org.jenkins-ci.plugins:token-macro · fixed in 2.8
- CVE-2019-10338A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient aMaven · org.jenkins-ci.plugins:jx-resources · fixed in 1.0.37
- CVE-2019-10339A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users witMaven · org.jenkins-ci.plugins:jx-resources · fixed in 1.0.37
- CVE-2019-10331A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.7
- CVE-2019-10332A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/ReaMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.7
- CVE-2019-10333Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access Maven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.7
- CVE-2019-10334Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.7
- CVE-2019-10335A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in JenMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.7
- CVE-2019-10336A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the outputMaven · org.jenkins-ci.plugins:electricflow · fixed in 1.1.7
- CVE-2019-12741XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0.Maven · ca.uhn.hapi.fhir:hapi-fhir-base · fixed in 3.8.0
- CVE-2019-12728Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service.Maven · org.grails:grails-core · fixed in 3.3.10
- CVE-2019-6588In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into theMaven · com.liferay.portal:release.portal.bom · fixed in 7.1.0
- CVE-2019-3802Additional information exposure with Spring Data JPA example matcherMaven · org.springframework.data:spring-data-jpa · fixed in 2.1.8, 1.11.22