Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-1003009An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/Maven · org.jenkins-ci.plugins:active-directory · fixed in 2.11
- CVE-2019-1003010A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.jMaven · org.jenkins-ci.plugins:git · fixed in 3.9.2
- CVE-2019-1003011An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinMaven · org.jenkins-ci.plugins:token-macro · fixed in 2.6
- CVE-2019-1003012A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueMaven · io.jenkins.blueocean:blueocean · fixed in 1.10.2
- CVE-2019-1003013An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/Maven · io.jenkins.blueocean:blueocean · fixed in 1.10.2
- CVE-2019-1003014An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/Maven · org.jenkins-ci.plugins:config-file-provider · fixed in 3.5
- CVE-2019-1003015An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/Maven · org.jenkins-ci.plugins:job-import-plugin · fixed in 3.0
- CVE-2019-1003016An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugiMaven · org.jenkins-ci.plugins:job-import-plugin · fixed in 3.0
- CVE-2019-1003017A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy Maven · org.jenkins-ci.plugins:job-import-plugin · fixed in 3.1
- CVE-2019-1003018An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/coMaven · org.jenkins-ci.plugins:github-oauth · fixed in 0.31
- CVE-2019-1003019An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unMaven · org.jenkins-ci.plugins:github-oauth · fixed in 0.31
- CVE-2019-1003020A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that alMaven · org.jenkins-ci.plugins:kanboard · fixed in 1.5.11
- CVE-2019-1003021An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealMaven · org.jenkins-ci.plugins:oic-auth · fixed in 1.5
- CVE-2019-1003022A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill thMaven · org.jvnet.hudson.plugins:monitoring · fixed in 1.75.0
- CVE-2019-1003023A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/pluginsMaven · io.jenkins.plugins:warnings-ng · fixed in 2.0.0
- CVE-2019-6986SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular exprMaven · org.vivoweb:vitro-project · fixed in 1.11.0
- CVE-2019-6804An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditoMaven · org.rundeck:rundeck · fixed in 3.0.13
- CVE-2018-1000997A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/maMaven · org.jenkins-ci.main:jenkins-core, org.kohsuke.stapler:stapler-parent · fixed in 2.138.2, 2.146, 1.250.2
- CVE-2019-1003000A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbMaven · org.jenkins-ci.plugins:script-security · fixed in 1.50
- CVE-2019-1003001A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFloMaven · org.jenkins-ci.plugins.workflow:workflow-cps-parent, org.jenkins-ci.plugins:pipeline-model-definition +1 · fixed in 2.61.1, 1.3.4.1, 1.50
- CVE-2019-1003002A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenMaven · org.jenkinsci.plugins:pipeline-model-definition · fixed in 1.3.4.1
- CVE-2019-1003003An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.150.2, 2.159
- CVE-2019-1003004An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.159
- CVE-2019-3772Spring Integration XML External Entity Injection (XXE)Maven · org.springframework.integration:spring-integration-ws, org.springframework.integration:spring-integration-xml · fixed in 4.3.19, 5.0.11, 5.1.2
- CVE-2019-3773Spring Web Services XML External Entity Injection (XXE)Maven · org.springframework.ws:spring-ws, org.springframework.ws:spring-xml · fixed in 2.4.4, 3.0.6
- CVE-2019-3774Spring Batch XML External Entity Injection (XXE)Maven · org.springframework.batch:spring-batch-core · fixed in 3.0.10.RELEASE, 4.0.2.RELEASE, 4.1.1.RELEASE
- CVE-2018-1000406A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.2, 2.146
- CVE-2018-1000407A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.javMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.2, 2.146
- CVE-2018-1000408A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.2, 2.146
- CVE-2018-1000409A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.2, 2.146