Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10240Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS.Maven · org.eclipse.hawkbit:hawkbit-autoconfigure, org.eclipse.hawkbit:hawkbit-boot-starter +8 · fixed in 0.3.0M2
- CVE-2019-1010260Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM.Maven · com.github.shyiko.ktlint:ktlint-core · fixed in 0.30.0
- CVE-2019-10686An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT.Maven · com.ctrip.framework.apollo:apollo
- CVE-2019-10648Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomMaven · net.sf.robocode:robocode.host · fixed in 1.9.3.7
- CVE-2019-0212In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBaseMaven · org.apache.hbase:hbase · fixed in 2.0.5, 2.1.4
- CVE-2019-0222In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.Maven · org.apache.activemq:activemq-client · fixed in 5.15.9
- CVE-2019-0225A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, whicMaven · org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M3
- CVE-2019-0224In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session.Maven · org.apache.jspwiki:jspwiki-main · fixed in 2.11.0.M3
- CVE-2019-1003048A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtMaven · com.programmingresearch:prqa-plugin · fixed in 3.1.2
- CVE-2019-1003040A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandbMaven · org.jenkins-ci.plugins:script-security · fixed in 1.56
- CVE-2019-1003041A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2.65
- CVE-2019-1003042A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names toMaven · org.6wind.jenkins:lockable-resources · fixed in 2.5
- CVE-2019-1003043A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect toMaven · org.jenkins-ci.plugins:slack · fixed in 2.20
- CVE-2019-1003044A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-Maven · org.jenkins-ci.plugins:slack · fixed in 2.20
- CVE-2019-1003045A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system Maven · de.eacg:ecs-publisher · fixed in 1.0.1
- CVE-2019-1003046A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a coMaven · org.jenkins-ci.plugins:fortify-on-demand-uploader · fixed in 3.0.11
- CVE-2019-1003047A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to Maven · org.jenkins-ci.plugins:fortify-on-demand-uploader · fixed in 3.0.11
- CVE-2018-12545In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.12.v20180830, 9.3.25.v20180904
- CVE-2019-0204A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the comMaven · org.apache.mesos:mesos · fixed in 1.4.3, 1.5.3, 1.6.2 and more
- CVE-2019-7611A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disMaven · org.elasticsearch:elasticsearch · fixed in 5.6.15, 6.6.1
- CVE-2019-0191Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file.Maven · org.apache.karaf:apache-karaf, org.apache.karaf:karaf · fixed in 4.2.3
- CVE-2018-11767In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uMaven · org.apache.hadoop:hadoop-main · fixed in 2.7.7, 2.8.5, 2.9.2
- CVE-2018-12022An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.7.9.4, 2.8.11.2, 2.9.6
- CVE-2018-12023An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.7.9.4, 2.8.11.2, 2.9.6
- CVE-2019-9843In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entitMaven · com.diffplug.spotless:spotless-maven-plugin, com.diffplug.spotless:spotless-plugin-gradle · fixed in 1.20.0, 3.20.0
- CVE-2019-5919An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtaMaven · com.nablarch.framework:nablarch-fw-web · fixed in 1.5.1
- CVE-2019-9658Checkstyle before 8.18 loads external DTDs by default.Maven · com.puppycrawl.tools:checkstyle · fixed in 8.18
- CVE-2017-3164Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive).Maven · org.apache.solr:solr-core · fixed in 7.7.0
- CVE-2019-1003029A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuriMaven · org.jenkins-ci.plugins:script-security · fixed in 1.54
- CVE-2019-1003030A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/woMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2.64