Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1000410An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.2, 2.146
- CVE-2018-1000411A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the descriMaven · org.jenkins-ci.plugins:junit · fixed in 1.26
- CVE-2018-1000412An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Maven · org.jenkins-ci.plugins:jira · fixed in 3.0.2
- CVE-2018-1000413A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly Maven · org.jenkins-ci.plugins:config-file-provider · fixed in 3.2
- CVE-2018-1000414A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FoldMaven · org.jenkins-ci.plugins:config-file-provider · fixed in 3.2
- CVE-2018-1000415A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuiMaven · com.sonyericsson.hudson.plugins.rebuild:rebuild · fixed in 1.29
- CVE-2018-1000416A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 2.18.1
- CVE-2018-1000417A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.jMaven · org.jenkins-ci.plugins:email-ext · fixed in 1.1
- CVE-2018-1000418An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers witMaven · org.jvnet.hudson.plugins:hipchat · fixed in 2.2.1
- CVE-2018-1000419An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers witMaven · org.jvnet.hudson.plugins:hipchat · fixed in 2.2.1
- CVE-2018-1000420An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with OverMaven · org.jenkins-ci.plugins:mesos · fixed in 0.18
- CVE-2018-1000421An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with OverMaven · org.jenkins-ci.plugins:mesos · fixed in 0.18
- CVE-2018-1000422An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allowMaven · org.jenkins-ci.plugins:crowd2 · fixed in 2.0.1
- CVE-2018-1000423An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.jMaven · org.jenkins-ci.plugins:crowd2 · fixed in 2.0.1
- CVE-2018-1000424An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CrMaven · org.jenkins-ci.plugins:artifactory · fixed in 2.16.2
- CVE-2018-1000425An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java tMaven · org.jenkins-ci.plugins:sonar · fixed in 2.8.1
- CVE-2018-1000426A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GMaven · de.wellnerbou.jenkins:git-changelog · fixed in 2.7
- CVE-2016-10735In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability thanMaven · org.webjars:bootstrap · fixed in 3.4.0, 4.0.0-beta.2
- CVE-2018-20676In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.Maven · org.webjars:bootstrap · fixed in 3.4.0
- CVE-2018-20677In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.Maven · org.webjars:bootstrap · fixed in 3.4.0
- CVE-2018-11798The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in whiMaven · org.apache.thrift:libthrift · fixed in 0.12.0
- CVE-2018-1320Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.tMaven · org.apache.thrift:libthrift · fixed in 0.9.3-1, 0.12.0
- CVE-2018-11788Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folMaven · org.apache.karaf.specs:org.apache.karaf.specs.java.xml · fixed in 4.2.2, 4.1.7
- CVE-2019-5312An issue was discovered in weixin-java-tools v3.3.0.Maven · com.github.binarywang:weixin-java-common · fixed in 3.3.2.B
- CVE-2018-20663The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" nMaven · com.haulmont.cuba:cuba-web-toolkit · fixed in 6.10.7, 6.9.8, 6.8.15
- CVE-2018-18893Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.Maven · com.hubspot.jinjava:jinjava · fixed in 2.4.6
- CVE-2018-14718FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.7, 2.8.11.3, 2.7.9.5 and more
- CVE-2018-14719FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.7, 2.8.11.3, 2.7.9.5
- CVE-2018-14720FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to blocMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.7, 2.8.11.3, 2.7.9.5
- CVE-2018-14721FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveragingMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.7, 2.8.11.3, 2.7.9.5