Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-12610In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protMaven · org.apache.kafka:kafka-clients · fixed in 0.10.2.2, 0.11.0.2
- CVE-2018-1288In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reseMaven · org.apache.kafka:kafka · fixed in 0.10.2.2, 0.11.0.3, 1.0.1
- CVE-2018-1002200plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) Maven · org.codehaus.plexus:plexus-archiver · fixed in 3.6.0
- CVE-2018-1002201zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip aMaven · org.zeroturnaround:zt-zip · fixed in 1.13
- CVE-2018-1002202zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip aMaven · net.lingala.zip4j:zip4j · fixed in 1.3.3
- CVE-2018-11047Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 4.5.7, 4.7.6, 4.10.2 and more
- CVE-2018-10912keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement.Maven · org.keycloak:keycloak-core · fixed in 4.0.0
- CVE-2018-8031The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a maliciousMaven · org.apache.tomee:tomee-webapp · fixed in 7.0.5
- CVE-2018-1999001A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allowsMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.2, 2.132
- CVE-2018-1999002A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.2, 2.132
- CVE-2018-1999003A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with OveMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.2, 2.133
- CVE-2018-1999004A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.2, 2.132
- CVE-2018-1999005A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidgMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.2, 2.132
- CVE-2018-1999006A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.121.2, 2.132
- CVE-2018-1999007A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/staMaven · org.jenkins-ci.main:jenkins-core, org.kohsuke.stapler:stapler-parent · fixed in 2.121.2, 2.132, 1.250.1
- CVE-2018-8018In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/Maven · org.apache.ignite:ignite-core · fixed in 2.6
- CVE-2018-14380In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueMaven · org.graylog2:graylog2-server · fixed in 2.4.6
- CVE-2018-14371The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameteMaven · org.glassfish:mojarra-parent · fixed in 2.3.7
- CVE-2018-13864A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when rMaven · com.typesafe.play:play_2.12 · fixed in 2.6.16
- CVE-2017-2638It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints.Maven · org.infinispan:infinispan-server-core · fixed in 9.0.0
- CVE-2018-14040In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.Maven · org.webjars:bootstrap · fixed in 4.1.2, 3.4.0
- CVE-2018-14041In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.Maven · org.webjars:bootstrap · fixed in 4.1.2
- CVE-2018-14042In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.Maven · org.webjars:bootstrap · fixed in 4.1.2, 3.4.0
- CVE-2018-12540In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form pMaven · io.vertx:vertx-web · fixed in 3.5.3
- CVE-2018-1334In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connectMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 · fixed in 2.1.3, 2.2.2, 2.3.1
- CVE-2018-8024In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark clusterMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 · fixed in 2.1.3, 2.2.2, 2.3.1
- CVE-2018-1331In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a securMaven · org.apache.storm:storm-core · fixed in 1.2.2, 1.1.3
- CVE-2018-1337In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connectiMaven · org.apache.directory.api:apache-ldap-api · fixed in 1.0.2
- CVE-2016-10726The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack withMaven · org.dspace:dspace-xmlui · fixed in 4.5, 5.5, 3.6
- CVE-2018-1000613Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Maven · org.bouncycastle:bcprov-jdk15on · fixed in 1.60