Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-15756DoS Attack via Range RequestsMaven · org.springframework:spring-core · fixed in 5.1.1.RELEASE, 5.0.10.RELEASE, 4.3.20.RELEASE
- CVE-2018-15758Privilege Escalation in spring-security-oauth2Maven · org.springframework.security.oauth:spring-security-oauth2 · fixed in 2.0.16, 2.1.3, 2.2.3.RELEASE and more
- CVE-2018-3258Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J).Maven · mysql:mysql-connector-java · fixed in 8.0.13
- CVE-2018-18389Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLSMaven · org.neo4j:neo4j-enterprise · fixed in 3.4.9
- CVE-2018-18240Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not useMaven · ro.pippo:pippo-core, ro.pippo:pippo-session · fixed in 1.12.0
- CVE-2018-12541In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the hMaven · io.vertx:vertx-core · fixed in 3.5.4
- CVE-2018-12542In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restMaven · io.vertx:vertx-web · fixed in 3.5.4
- CVE-2018-12544In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense Maven · io.vertx:vertx-core · fixed in 3.5.4
- CVE-2018-8006An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp paMaven · org.apache.activemq:activemq-web-console · fixed in 5.15.6
- CVE-2018-11796In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing.Maven · org.apache.tika:tika-core · fixed in 1.19.1
- CVE-2018-11797In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation whenMaven · org.apache.pdfbox:pdfbox · fixed in 1.8.16, 2.0.12
- CVE-2018-11778UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow.Maven · org.apache.ranger:ranger · fixed in 1.2.0
- CVE-2018-11784When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directoMaven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 8.5.34, 7.0.91, 9.0.12
- CVE-2018-17785In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as deMaven · com.github.blynkkk:blynk-server · fixed in 0.39.7
- CVE-2018-17605An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails.Maven · org.grails.plugins:asset-pipeline · fixed in 3.0.4
- CVE-2018-16277The Image Import function in XWiki through 10.7 has XSS.Maven · org.xwiki.platform:xwiki-platform
- CVE-2018-15531JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.Maven · net.bull.javamelody:javamelody-core · fixed in 1.74.0
- CVE-2018-17366An issue was discovered in MCMS 4.6.5.Maven · net.mingsoft:ms-mcms
- CVE-2018-8023Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT).Maven · org.apache.mesos:mesos · fixed in 1.4.2, 1.5.2, 1.6.1
- CVE-2018-17297The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequMaven · cn.hutool:hutool-all, cn.hutool:hutool-core +1 · fixed in 4.1.12
- CVE-2018-3824X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability.Maven · org.elasticsearch:elasticsearch · fixed in 5.6.9, 6.2.4
- CVE-2018-3831Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured viMaven · org.elasticsearch:elasticsearch · fixed in 5.6.12, 6.4.1
- CVE-2018-11761In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion.Maven · org.apache.tika:tika-core · fixed in 1.19.1
- CVE-2018-11762In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and tMaven · org.apache.tika:tika-core · fixed in 1.19
- CVE-2018-8017In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.Maven · org.apache.tika:tika-core · fixed in 1.19
- CVE-2018-11786In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any useMaven · org.apache.karaf:apache-karaf · fixed in 4.2.0
- CVE-2018-11787In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/consoMaven · org.apache.karaf:apache-karaf · fixed in 3.0.9, 4.0.9, 4.1.1
- CVE-2018-14642An information leak vulnerability was found in Undertow.Maven · io.undertow:undertow-core · fixed in 2.0.19.FINAL
- CVE-2018-8041Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.Maven · org.apache.camel:camel-mail · fixed in 2.20.4, 2.21.2, 2.22.1
- CVE-2018-11087TLS validation errorMaven · com.rabbitmq:amqp-client, org.springframework.amqp:spring-amqp · fixed in 4.8.0, 5.4.0, 2.0.6 and more