Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10321A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnecMaven · org.jenkins-ci.plugins:artifactory
- CVE-2019-10322A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed useMaven · org.jenkins-ci.plugins:artifactory
- CVE-2019-10323A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with OvMaven · org.jenkins-ci.plugins:artifactory
- CVE-2019-10324A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiActionMaven · org.jenkins-ci.plugins:artifactory · fixed in 3.2.3
- CVE-2019-10325A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to injecMaven · io.jenkins.plugins:warnings-ng · fixed in 5.1.0
- CVE-2019-10326A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for futMaven · io.jenkins.plugins:warnings-ng · fixed in 5.1.0
- CVE-2019-10327An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to controMaven · org.jenkins-ci.plugins:pipeline-maven · fixed in 3.7.1
- CVE-2019-10328Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitMaven · org.jenkins-ci.plugins:workflow-remote-loader · fixed in 1.5
- CVE-2019-10329Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they caMaven · org.jenkins-ci.plugins:influxdb · fixed in 1.22
- CVE-2019-10330Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to chanMaven · org.jenkins-ci.plugins:gitea · fixed in 1.1.2
- CVE-2018-8029In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run aMaven · org.apache.hadoop:hadoop-main · fixed in 2.8.4, 2.9.2, 3.1.1
- CVE-2019-0221The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without…Maven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.17, 8.5.40, 7.0.94
- CVE-2019-0188Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSOMaven · org.apache.camel:camel-core, org.apache.camel:camel-xmljson · fixed in 2.24.0
- CVE-2019-0201An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta.Maven · org.apache.zookeeper:zookeeper · fixed in 3.4.14, 3.5.5
- CVE-2016-10750In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization.Maven · com.hazelcast:hazelcast · fixed in 3.11
- CVE-2019-10320Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of fileMaven · org.jenkins-ci.plugins:credentials · fixed in 2.1.19
- CVE-2019-10078A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to sessMaven · org.apache.jspwiki:jspwiki-main, org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M4
- CVE-2019-10077A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijaMaven · org.apache.jspwiki:jspwiki-main, org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M4
- CVE-2019-10076A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to sessioMaven · org.apache.jspwiki:jspwiki-main, org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M4
- CVE-2019-12086A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.9, 2.8.11.4, 2.7.9.6 and more
- CVE-2013-7285Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run Maven · com.thoughtworks.xstream:xstream · fixed in 1.4.7, 1.4.11
- CVE-2016-7043It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properMaven · org.kie.server:kie-server-common · fixed in 7.21.0.Final
- CVE-2019-11082core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in theMaven · de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl
- CVE-2019-0226Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite exiMaven · org.apache.karaf.config:org.apache.karaf.config.core · fixed in 4.2.5
- CVE-2019-11819Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/acMaven · org.opencms:opencms-core · fixed in 11.0.0
- CVE-2019-11818Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/Maven · org.opencms:opencms-core · fixed in 11.0.0
- CVE-2019-11808Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom.Maven · io.ratpack:ratpack-groovy, io.ratpack:ratpack-java +1 · fixed in 1.6.1
- CVE-2018-17202Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which couMaven · org.apache.sanselan:sanselan
- CVE-2018-17201Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attackMaven · org.apache.sanselan:sanselan
- CVE-2019-10249All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been cMaven · org.eclipse.xtend:org.eclipse.xtend.core, org.eclipse.xtext:org.eclipse.xtext · fixed in 2.18.0