Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-11405OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and buildMaven · org.openapitools:openapi-generator · fixed in 4.0.0-20190419.052012-560
- CVE-2019-11404arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS.Maven · io.arrow-kt:arrow-ank-gradle · fixed in 0.9.0
- CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototypMaven · org.webjars.npm:jquery · fixed in 3.4.0
- CVE-2019-10300A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form vMaven · org.jenkins-ci.plugins:gitlab-plugin · fixed in 1.5.12
- CVE-2019-10301A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation methodMaven · org.jenkins-ci.plugins:gitlab-plugin · fixed in 1.5.12
- CVE-2019-10302Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they couMaven · org.jenkins-ci.plugins:jira-ext · fixed in 0.9
- CVE-2019-10303Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the JenkinsMaven · org.jenkins-ci.plugins:azure-publishersettings-credentials · fixed in 1.5
- CVE-2019-10304A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validatioMaven · com.xebialabs.deployit.ci:deployit-plugin · fixed in 7.5.5
- CVE-2019-10305A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows Maven · com.xebialabs.deployit.ci:deployit-plugin · fixed in 7.5.5
- CVE-2019-10306A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execMaven · org.jenkins-ci.plugins:ontrack · fixed in 3.4.1
- CVE-2019-0228Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XMaven · org.apache.pdfbox:pdfbox · fixed in 2.0.15
- CVE-2019-0232When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and…Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.17, 8.5.40, 7.0.94
- CVE-2019-1003050The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 aMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.164.2, 2.172
- CVE-2019-1003049Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated inMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.164.2, 2.172
- CVE-2019-0199The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS framesMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 9.0.16, 8.5.38
- CVE-2019-11065Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugMaven · org.gradle:gradle-core · fixed in 5.4.0
- CVE-2019-3795Insecure Randomness When Using a SecureRandom Instance Constructed by Spring SecurityMaven · org.springframework.security:spring-security-core · fixed in 4.2.12, 5.0.12, 5.1.5
- CVE-2019-10287Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where tMaven · org.jenkins-ci.plugins:youtrack-plugin · fixed in 0.7.2
- CVE-2019-10288Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · de.e-nexus:jabber-server-plugin
- CVE-2019-10289A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValMaven · org.jenkins-ci.plugins:netsparker-cloud-scan · fixed in 1.1.6
- CVE-2019-10290A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form vaMaven · org.jenkins-ci.plugins:netsparker-cloud-scan · fixed in 1.1.6
- CVE-2019-10291Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master wMaven · org.jenkins-ci.plugins:netsparker-cloud-scan · fixed in 1.1.6
- CVE-2019-10292A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackMaven · org.jenkins-ci.plugins:kmap-jenkins
- CVE-2019-10293A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with OverallMaven · org.jenkins-ci.plugins:kmap-jenkins
- CVE-2019-10294Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with ExteMaven · org.jenkins-ci.plugins:kmap-jenkins
- CVE-2019-10295Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:crittercism-dsym
- CVE-2019-10296Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieMaven · com.urbancode.ds.jenkins.plugins:sra-deploy
- CVE-2019-10297Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jenkins-ci.plugins:sametime
- CVE-2019-10298Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users Maven · org.jenkins-ci.plugins:koji
- CVE-2019-10299Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can beMaven · com.cloudcoreo.plugins:cloudcoreo-deploytime