Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1999026A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows aMaven · de.tracetronic.jenkins.plugins:ecutest · fixed in 2.4
- CVE-2018-1999027An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.Maven · org.jenkins-ci.plugins:saltstack · fixed in 3.1.7
- CVE-2018-1999028An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackMaven · org.jenkins-ci.plugins:accurev · fixed in 0.7.17
- CVE-2018-1999029A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjMaven · org.jenkins-ci.plugins:shelve-project-plugin · fixed in 2.0
- CVE-2018-1999030An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in AMaven · org.jenkins-ci.plugins:maven-artifact-choicelistprovider · fixed in 1.3.2
- CVE-2018-1999031An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that alMaven · org.jenkins-ci.plugins:meliora-testlab · fixed in 1.15
- CVE-2018-1999032A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.javMaven · org.jenkins-ci.plugins:pangolin-testrail-connector · fixed in 2.2
- CVE-2018-1999033An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilMaven · org.jenkins-ci.plugins:anchore-container-scanner · fixed in 1.0.17
- CVE-2018-1999034A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfigurMaven · com.inedo.proget:inedo-proget · fixed in 1.0
- CVE-2018-1999035A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterCoMaven · com.inedo.buildmaster:inedo-buildmaster · fixed in 2.0
- CVE-2018-1999036An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exMaven · org.jenkins-ci.plugins:ssh-agent · fixed in 1.16
- CVE-2018-1999037A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attaMaven · org.jenkins-ci.plugins:resource-disposer · fixed in 0.12
- CVE-2018-1999038A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allMaven · org.jenkins-ci.plugins:publish-over-cifs · fixed in 0.11
- CVE-2018-1999039A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that alloMaven · org.jenkins-ci.plugins:confluence-publisher · fixed in 2.0.2
- CVE-2018-1999040An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allowMaven · org.csanchez.jenkins.plugins:kubernetes · fixed in 1.10.2
- CVE-2018-1999041An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java tMaven · com.tinfoilsecurity.plugins:tinfoil-scan · fixed in 2.0
- CVE-2018-8027Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.Maven · org.apache.camel:camel-core · fixed in 2.20.4, 2.21.1
- CVE-2017-2648It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle atMaven · org.jenkins-ci.plugins:ssh-slaves · fixed in 1.15
- CVE-2017-2649It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active DirectorMaven · org.jenkins-ci.plugins:active-directory · fixed in 2.3
- CVE-2017-2650It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commMaven · cprice404:pipeline-classpath
- CVE-2017-2652It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that proviMaven · org.jenkins-ci.plugins:distfork · fixed in 1.6.0
- CVE-2017-2646It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParMaven · org.keycloak:keycloak-core · fixed in 2.5.5
- CVE-2017-2651jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamicallyMaven · org.jenkins-ci.plugins:mailer · fixed in 1.20
- CVE-2017-12165It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possMaven · io.undertow:undertow-core · fixed in 1.3.31, 1.4.17, 2.0.0.Beta1
- CVE-2017-2670It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effecMaven · io.undertow:undertow-core · fixed in 1.3.28
- CVE-2017-2666It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters.Maven · io.undertow:undertow-core · fixed in 1.3.31, 1.4.17
- CVE-2018-10862WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .warMaven · org.wildfly.core:wildfly-server · fixed in 6.0.0.Alpha3
- CVE-2017-2582It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining aMaven · org.keycloak:keycloak-core · fixed in 2.5.1
- CVE-2017-2589It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies arMaven · io.hawt:project · fixed in 1.5.0
- CVE-2017-7545It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files.Maven · org.jbpm.jbpm5:jbpmmigration