Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-3799Directory Traversal with spring-cloud-config-serverMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 1.4.6, 2.0.4, 2.1.2
- CVE-2019-3797Additional information exposure with Spring Data JPA derived queriesMaven · org.springframework.data:spring-data-jpa · fixed in 1.11.20, 2.0.14, 2.1.6
- CVE-2018-8035This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2)Maven · org.apache.uima:uima-ducc-web · fixed in 3.0.0
- CVE-2019-0227A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.Maven · axis:axis, org.apache.axis:axis
- CVE-2019-0214In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mecMaven · org.apache.archiva:archiva · fixed in 2.2.4
- CVE-2019-0213In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e.Maven · org.apache.archiva:archiva · fixed in 2.2.4
- CVE-2019-0194Apache Camel's File is vulnerable to directory traversal.Maven · org.apache.camel:camel-core · fixed in 2.21.5, 2.22.3, 2.23.1
- CVE-2019-10316Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master wheMaven · org.jenkins-ci.plugins:aqua-microscanner · fixed in 1.0.6
- CVE-2019-10317Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jvnet.hudson.plugins:sitemonitor · fixed in 0.6
- CVE-2019-10318Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins maMaven · org.jenkins-ci.plugins:azure-ad · fixed in 0.3.4
- CVE-2019-10307A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationViewMaven · org.jvnet.hudson.plugins:analysis-core · fixed in 1.96
- CVE-2019-10308A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form hanMaven · org.jvnet.hudson.plugins:analysis-core · fixed in 1.96
- CVE-2019-10309Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML ExternalMaven · org.jenkins-ci.plugins:swarm
- CVE-2019-10310A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescrMaven · org.jenkins-ci.plugins:ansible-tower · fixed in 0.9.2
- CVE-2019-10311A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestToweMaven · org.jenkins-ci.plugins:ansible-tower · fixed in 0.9.2
- CVE-2019-10312A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillToweMaven · org.jenkins-ci.plugins:ansible-tower · fixed in 0.9.2
- CVE-2019-10313Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:twitter
- CVE-2019-10314Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jenkins-ci.plugins:koji
- CVE-2019-10315Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.Maven · org.jenkins-ci.plugins:github-oauth · fixed in 0.32
- CVE-2019-0186The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks.Maven · org.apache.portals.pluto:chatroomdemo · fixed in 3.1.0
- CVE-2019-3868Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIMaven · org.keycloak:keycloak-core · fixed in 6.0.0
- CVE-2019-2692Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J).Maven · mysql:mysql-connector-java · fixed in 8.0.16
- CVE-2018-1328Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions.Maven · org.apache.zeppelin:zeppelin · fixed in 0.8.0
- CVE-2018-1317In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without aMaven · org.apache.zeppelin:zeppelin · fixed in 0.8.0
- CVE-2017-12619Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session.Maven · org.apache.zeppelin:zeppelin · fixed in 0.7.3
- CVE-2019-5427c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursiMaven · com.mchange:c3p0 · fixed in 0.9.5.4
- CVE-2019-10248Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS.Maven · org.eclipse.vorto:org.eclipse.vorto.core · fixed in 0.11.0
- CVE-2019-10241In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote clMaven · org.eclipse.jetty:jetty-server · fixed in 9.2.27.v20190403, 9.3.26.v20190403, 9.4.16.v20190411
- CVE-2019-10246In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base ResMaven · org.eclipse.jetty:jetty-server · fixed in 9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418
- CVE-2019-10247In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version Maven · org.eclipse.jetty:jetty-server · fixed in 9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418