Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1000863A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.4, 2.154
- CVE-2018-1000864A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with OvMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138.4, 2.154
- CVE-2018-1000865A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/Maven · org.jenkins-ci.plugins:script-security · fixed in 1.48
- CVE-2018-1000866A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandboxMaven · org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins:script-security · fixed in 2.60, 1.48
- CVE-2018-20000Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to wMaven · org.bedework:bw-webdav · fixed in 4.0.3
- CVE-2018-19907A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18.Maven · org.craftercms:crafter-studio
- CVE-2018-19859OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.Maven · org.openrefine:main · fixed in 3.2-beta
- CVE-2018-14637The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions.Maven · org.keycloak:keycloak-core · fixed in 4.6.0
- CVE-2018-11766In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete.Maven · org.apache.hadoop:hadoop-main · fixed in 2.7.7
- CVE-2018-15761UAA Privilege EscalationMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 4.23.0
- CVE-2018-17190In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'woMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11
- CVE-2018-8009Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the ziMaven · org.apache.hadoop:hadoop-main · fixed in 3.1.1, 3.0.3, 2.9.2 and more
- CVE-2018-14655A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final.Maven · org.keycloak:keycloak-parent
- CVE-2018-14657A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final.Maven · org.keycloak:keycloak-parent · fixed in 4.6.0.Final
- CVE-2018-14658A flaw was found in JBOSS Keycloak 3.2.1.Final.Maven · org.keycloak:keycloak-core
- CVE-2018-17187The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods.Maven · org.apache.qpid:proton-j · fixed in 0.30.0
- CVE-2018-15795CredHub Service Broker uses guessable client secretMaven · org.springframework.credhub:spring-credhub-core · fixed in 1.1.0
- CVE-2018-11777In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if rangerMaven · org.apache.hive:hive-exec · fixed in 3.1.1, 2.3.4
- CVE-2018-1314In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a queryMaven · org.apache.hive:hive-jdbc · fixed in 2.3.4, 3.1.1
- CVE-2018-14667The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource.Maven · org.richfaces:richfaces-core · fixed in 3.3.4
- CVE-2018-17186An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, Maven · org.apache.syncope:syncope-core · fixed in 2.0.11, 2.1.2
- CVE-2018-17184A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector namesMaven · org.apache.syncope:syncope-core · fixed in 2.0.11, 2.1.2
- CVE-2018-18853Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Maven · io.spray:spray-json_2.10, io.spray:spray-json_2.11 +1 · fixed in 1.3.5
- CVE-2018-18854Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Maven · io.spray:spray-json_2.10, io.spray:spray-json_2.11 +1 · fixed in 1.3.5
- CVE-2018-18830An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5.Maven · net.mingsoft:ms-mcms
- CVE-2018-18831An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5.Maven · net.mingsoft:ms-mcms
- CVE-2018-11804Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation.Maven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11
- CVE-2017-18349parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute…Maven · com.alibaba:fastjson, ro.pippo:pippo-fastjson · fixed in 1.2.31, 1.12.0
- CVE-2018-18628An issue was discovered in Pippo 1.11.0.Maven · ro.pippo:pippo-core · fixed in 1.12.0
- CVE-2018-18531text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 usMaven · com.github.penggle:kaptcha