Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-19360FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transpMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.8, 2.8.11.3, 2.7.9.5
- CVE-2018-19361FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clasMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.7.9.5, 2.9.8, 2.8.11.3
- CVE-2018-19362FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-commonMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.8, 2.8.11.3, 2.7.9.5 and more
- CVE-2018-20594An issue was discovered in hsweb 3.0.4.Maven · org.hswebframework.web:hsweb-commons
- CVE-2018-20595A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter inMaven · org.hswebframework.web:hsweb-commons
- CVE-2018-17197A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.Maven · org.apache.tika:tika-parsers · fixed in 1.20
- CVE-2018-20433c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.Maven · com.mchange:c3p0 · fixed in 0.9.5.3
- CVE-2018-17244Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active DirMaven · org.elasticsearch:elasticsearch · fixed in 6.4.3
- CVE-2018-17247Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API.Maven · org.elasticsearch:elasticsearch · fixed in 6.5.2
- CVE-2018-1000873Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result iMaven · com.fasterxml.jackson.datatype:jackson-datatype-jsr310 · fixed in 2.9.8
- CVE-2018-1000854esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream CoMaven · org.esigate:esigate-core · fixed in 5.3
- CVE-2018-1000817Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerabiMaven · org.grails.plugins:asset-pipeline · fixed in 2.14.1, 2.15.1, 3.0.6
- CVE-2018-1000820neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can Maven · org.neo4j.procedure:apoc · fixed in 3.4.0.4
- CVE-2018-1000822codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in DisMaven · org.codelibs.fess:fess · fixed in 12.3.2
- CVE-2018-1000823exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure ofMaven · org.exist-db:exist-core · fixed in 5.1.0
- CVE-2018-1000836bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser thaMaven · org.bedework.caleng:bw-calendar-engine
- CVE-2018-1000844Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerabilMaven · com.squareup.retrofit2:retrofit · fixed in 2.5.0
- CVE-2018-1000850Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder cMaven · com.squareup.retrofit2:retrofit · fixed in 2.5.0
- CVE-2018-15801Authorization Bypass During JWT Issuer Validation with spring-securityMaven · org.springframework.security:spring-security-core, org.springframework.security:spring-security-oauth2-jose · fixed in 5.1.2
- CVE-2018-11799Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users.Maven · org.apache.oozie:oozie-core · fixed in 5.1.0
- CVE-2018-17192The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers.Maven · org.apache.nifi:nifi · fixed in 1.8.0
- CVE-2018-17193The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected Maven · org.apache.nifi:nifi · fixed in 1.8.0
- CVE-2018-17194When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded.Maven · org.apache.nifi:nifi-framework-cluster · fixed in 1.8.0
- CVE-2018-17195The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTMaven · org.apache.nifi:nifi · fixed in 1.8.0
- CVE-2018-20227RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.Maven · org.eclipse.rdf4j:rdf4j · fixed in 2.5.0
- CVE-2018-19413A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as vMaven · org.sonarsource.sonarqube:sonar-plugin-api · fixed in 7.5
- CVE-2018-20094An issue was discovered in XXL-CONF 1.6.0.Maven · com.xuxueli:xxl-conf-admin
- CVE-2018-20059jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.Maven · ro.pippo:pippo-core · fixed in 1.12.0
- CVE-2018-1000861A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/corMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.4, 2.154
- CVE-2018-1000862An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that alloMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.4, 2.154