Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1330When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception.Maven · org.apache.mesos:mesos · fixed in 1.6.0
- CVE-2018-1114It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file deMaven · io.undertow:undertow-core · fixed in 1.4.25.Final, 2.0.5.Final
- CVE-2016-0750The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.Maven · org.infinispan:infinispan-core · fixed in 9.1.0.Final
- CVE-2018-11775TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM aMaven · org.apache.activemq:activemq-client · fixed in 5.15.6
- CVE-2018-1000665Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOMaven · org.dojotoolkit:dojo · fixed in 1.14
- CVE-2018-10936A weakness was found in postgresql-jdbc before version 42.2.5.Maven · org.postgresql:pgjdbc-aggregate · fixed in 42.2.5
- CVE-2018-16131The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attaMaven · com.typesafe.akka:akka-http-core_2.11, com.typesafe.akka:akka-http-core_2.12 · fixed in 10.1.4
- CVE-2018-16115Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error.Maven · com.typesafe.akka:akka-actor_2.11, com.typesafe.akka:akka-actor_2.12 · fixed in 2.5.16
- CVE-2018-1999042A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a doMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.3, 2.138
- CVE-2018-1999043A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.3, 2.138
- CVE-2018-1999044A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with OveralMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.138
- CVE-2018-1999045A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.3, 2.138
- CVE-2018-1999046A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attaMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.3, 2.138
- CVE-2018-1999047A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers tMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.3, 2.138
- CVE-2018-8028An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1.Maven · org.apache.sentry:sentry · fixed in 2.0.1
- CVE-2018-11758This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2.Maven · org.apache.cayenne:cayenne-parent · fixed in 3.1.3, 4.1
- CVE-2018-11776Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (eiMaven · org.apache.struts:struts2-core · fixed in 2.3.35, 2.5.17
- CVE-2018-1000632dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element.Maven · dom4j:dom4j, org.dom4j:dom4j · fixed in 2.0.3, 2.1.1
- CVE-2018-1000644Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can Maven · org.eclipse.rdf4j:rdf4j-runtime · fixed in 2.4.0
- CVE-2018-11771When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to retMaven · org.apache.commons:commons-compress · fixed in 1.18
- CVE-2018-12537In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and linMaven · io.vertx:vertx-core · fixed in 3.5.2
- CVE-2018-11770From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism uMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11
- CVE-2017-2654jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure.Maven · org.jenkins-ci.plugins:email-ext · fixed in 2.57.1
- CVE-2018-1336An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a DenMaven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.8, 8.5.31, 8.0.51 and more
- CVE-2018-8037If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existedMaven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.10, 8.5.32
- CVE-2018-8032Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.Maven · axis:axis, org.apache.axis:axis
- CVE-2018-8034The host name verification when using TLS with the WebSocket client was missing.Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.10, 8.5.32, 8.0.53 and more
- CVE-2016-8609It was found that the keycloak before 2.3.0 did not implement authentication flow correctly.Maven · org.keycloak:keycloak-core · fixed in 2.3.0
- CVE-2018-10894It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates.Maven · org.keycloak:keycloak-saml-adapter-core, org.keycloak:keycloak-services · fixed in 4.4.0.Final
- CVE-2018-1999025A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java thatMaven · de.tracetronic.jenkins.plugins:ecutest · fixed in 2.4