Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-1003031A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScriptMaven · org.jenkins-ci.plugins:matrix-project · fixed in 1.14
- CVE-2019-1003032A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/EMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.65
- CVE-2019-1003033A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSMaven · org.jenkins-ci.plugins:groovy · fixed in 2.2
- CVE-2019-1003034A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstraMaven · org.jenkins-ci.plugins:job-dsl · fixed in 1.72
- CVE-2019-1003035An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagenMaven · org.jenkins-ci.plugins:azure-vm-agents · fixed in 0.8.1
- CVE-2019-1003036A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzMaven · org.jenkins-ci.plugins:azure-vm-agents · fixed in 0.8.1
- CVE-2019-1003037An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagenMaven · org.jenkins-ci.plugins:azure-vm-agents · fixed in 0.8.1
- CVE-2019-1003038An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jMaven · org.jenkins-ci.plugins:repository-connector · fixed in 1.2.5
- CVE-2019-1003039An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/cMaven · org.jenkins-ci.plugins:appdynamics-dashboard · fixed in 1.0.15
- CVE-2019-0192In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request.Maven · org.apache.solr:solr-core · fixed in 7.0.0
- CVE-2019-3778Open Redirect in spring-security-oauth2Maven · org.springframework.security.oauth:spring-security-oauth, org.springframework.security.oauth:spring-security-oauth2 · fixed in 2.0.17.RELEASE, 2.1.4.RELEASE, 2.2.4.RELEASE and more
- CVE-2019-0200A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticatMaven · org.apache.qpid:apache-qpid-broker-j · fixed in 7.0.7, 7.1.1
- CVE-2019-0187Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options).Maven · org.apache.jmeter:apachejmeter · fixed in 5.1
- CVE-2018-11793When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.Maven · org.apache.mesos:mesos · fixed in 1.4.3, 1.5.2, 1.6.2 and more
- CVE-2019-9212SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklistinMaven · com.alipay.sofa:hessian · fixed in 4.0.2, 3.3.6
- CVE-2019-9142An issue was discovered in b3log Symphony (aka Sym) before v3.4.7.Maven · org.b3log:symphony · fixed in 3.4.7
- CVE-2019-1003024A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows aMaven · org.jenkins-ci.plugins:script-security · fixed in 1.53
- CVE-2019-1003025A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriMaven · org.jenkins-ci.plugins:cloudfoundry · fixed in 2.3.2
- CVE-2019-1003026A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java thMaven · org.jenkins-ci.plugins:mattermost · fixed in 2.6.3
- CVE-2019-1003027A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allowsMaven · hudson.plugins.octopusdeploy:octopusdeploy · fixed in 1.9.0
- CVE-2019-1003028A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.jMaven · org.jenkins-ci.plugins:jms-messaging · fixed in 1.1.2
- CVE-2019-8331In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.Maven · org.webjars:bootstrap · fixed in 3.4.1, 4.3.1
- CVE-2018-20242A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijackMaven · org.apache.jspwiki:jspwiki-war · fixed in 2.11.0.M1
- CVE-2019-7722PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tamperiMaven · net.sourceforge.pmd:pmd-core · fixed in 6.0.0
- CVE-2018-1296In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during liMaven · org.apache.hadoop:hadoop-main · fixed in 2.7.6, 2.8.4, 2.9.1
- CVE-2018-1340Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token.Maven · org.apache.guacamole:guacamole-common · fixed in 1.0.0
- CVE-2019-1003005A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuriMaven · org.jenkins-ci.plugins:script-security · fixed in 1.51
- CVE-2019-1003006A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.javMaven · org.jenkins-ci.plugins:groovy · fixed in 2.1
- CVE-2019-1003007A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GrooMaven · org.jvnet.hudson.plugins:warnings · fixed in 5.0.1
- CVE-2019-1003008A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/pMaven · io.jenkins.plugins:warnings-ng