Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-1003059A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with OverMaven · org.jvnet.hudson.plugins:ftppublisher
- CVE-2019-1003060Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viMaven · org.jenkins-ci.plugins:zap
- CVE-2019-1003061Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be Maven · org.jenkins-ci.plugins:jenkins-cloudformation-plugin
- CVE-2019-1003062Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where theMaven · org.jenkins-ci.plugins:aws-cloudwatch-logs-publisher
- CVE-2019-1003063Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they caMaven · org.jenkins-ci.plugins:snsnotify · fixed in 2.37
- CVE-2019-1003064Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieweMaven · org.jenkins-ci.plugins:aws-device-farm · fixed in 1.26
- CVE-2019-1003065Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they caMaven · org.jenkins-ci.plugins:cloudshare-docker
- CVE-2019-1003066Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jvnet.hudson.plugins:bugzilla
- CVE-2019-1003067Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usersMaven · org.jenkins-ci.plugins:trac-publisher-plugin
- CVE-2019-1003068Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be vieMaven · com.inkysea.vmware.vra:vmware-vrealize-automation-plugin
- CVE-2019-1003069Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can beMaven · org.jenkins-ci.plugins:aqua-security-scanner · fixed in 3.0.16
- CVE-2019-1003070Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewMaven · org.jenkins-ci.plugins:veracode-scanner
- CVE-2019-1003071Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · hudson.plugins.octopusdeploy:octopusdeploy · fixed in 1.9.0
- CVE-2019-1003072Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:wildfly-deployer
- CVE-2019-1003073Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where theMaven · org.jenkins-ci.plugins:vsts-cd
- CVE-2019-1003074Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewMaven · sh.hyper.plugins:hyper-commons
- CVE-2019-1003075Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieMaven · org.jenkins-ci.plugins:audit2db
- CVE-2019-1003076A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection foMaven · org.jenkins-ci.plugins:audit2db
- CVE-2019-1003077A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation meMaven · org.jenkins-ci.plugins:audit2db
- CVE-2019-1003078A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection forMaven · org.jenkins-ci.plugins:labmanager
- CVE-2019-1003079A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation metMaven · org.jenkins-ci.plugins:labmanager
- CVE-2019-1003080A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2019-1003081A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2019-1003082A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method alloMaven · org.jenkins-ci.plugins:gearman-plugin · fixed in 0.4.0
- CVE-2019-1003051Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wMaven · org.jvnet.hudson.plugins:ircbot
- CVE-2019-1003052Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where tMaven · org.jenkins-ci.plugins:aws-beanstalk-publisher-plugin
- CVE-2019-1003053Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users withMaven · org.jenkins-ci.plugins:hockeyapp
- CVE-2019-1003054Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by uMaven · info.bluefloyd.jenkins:jenkins-jira-issue-updater
- CVE-2019-1003055Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · org.jvnet.hudson.plugins:ftppublisher
- CVE-2014-3603The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6Maven · edu.internet2.middleware:shibboleth-identityprovider, org.opensaml:opensaml · fixed in 2.4.1, 2.6.2