Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1000401Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWMaven · com.amazonaws:aws-codepipeline · fixed in 0.37
- CVE-2018-1000402Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AMaven · com.amazonaws:codedeploy · fixed in 1.20
- CVE-2018-1000403Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCMaven · com.amazonaws:codedeploy · fixed in 1.20
- CVE-2018-1000404Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClMaven · com.amazonaws:aws-codebuild · fixed in 0.27
- CVE-2018-13439WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.Maven · com.github.wxpay:wxpay-sdk
- CVE-2018-8026This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (Maven · org.apache.solr:solr-core · fixed in 7.4.0, 6.6.5
- CVE-2018-8038Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity ProviderMaven · org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9 +3 · fixed in 1.4.4
- CVE-2018-8036In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to anMaven · org.apache.pdfbox:pdfbox · fixed in 1.8.15, 2.0.11
- CVE-2018-8039It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.Maven · org.apache.cxf:apache-cxf, org.apache.cxf:cxf-rt-transports-http · fixed in 3.2.5, 3.1.16
- CVE-2018-13003An issue was discovered in OpenTSDB 2.3.0.Maven · net.opentsdb:opentsdb
- CVE-2018-12972An issue was discovered in OpenTSDB 2.3.0.Maven · net.opentsdb:opentsdb
- CVE-2018-12973An issue was discovered in OpenTSDB 2.3.0.Maven · net.opentsdb:opentsdb
- CVE-2018-8016The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, whichMaven · org.apache.cassandra:cassandra-all · fixed in 3.11.2
- CVE-2018-1306The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain seMaven · org.apache.portals.pluto:pluto-container · fixed in 3.0.1
- CVE-2018-12536In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.11.v20180605, 9.3.24.v20180605
- CVE-2018-8025CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP.Maven · org.apache.hbase:hbase-thrift · fixed in 2.0.1, 1.4.5, 1.3.2.1 and more
- CVE-2017-7658In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when prMaven · org.eclipse.jetty:jetty-server · fixed in 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605
- CVE-2018-1000600A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java tMaven · com.coravy.hudson.plugins.github:github · fixed in 1.29.2
- CVE-2018-1000601A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attMaven · org.jenkins-ci.plugins:credentials, org.jenkins-ci.plugins:ssh-credentials · fixed in 2.1.17, 1.14
- CVE-2018-1000602A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackerMaven · org.jenkins-ci.plugins:saml · fixed in 1.0.7
- CVE-2018-1000603A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRMaven · org.jenkins-ci.plugins:openstack-cloud · fixed in 2.37
- CVE-2018-1000604A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.jaMaven · org.jenkins-ci.plugins:badge · fixed in 1.5
- CVE-2018-1000605A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieMaven · org.jenkins-ci.plugins:collabnet · fixed in 2.0.5
- CVE-2018-1000606A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers wiMaven · org.jenkins-ci.plugins:urltrigger · fixed in 0.43
- CVE-2018-1000607A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers Maven · org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin · fixed in 1.5.2
- CVE-2018-1000608A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows anMaven · org.jenkins-ci.plugins:zos-connector · fixed in 2.0.0
- CVE-2018-1000609A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCodMaven · io.jenkins:configuration-as-code · fixed in 0.8-alpha
- CVE-2018-1000610A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfiguraMaven · io.jenkins:configuration-as-code · fixed in 0.8-alpha
- CVE-2017-7657In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabledMaven · org.eclipse.jetty:jetty-server · fixed in 9.2.25.v20180606, 9.3.24.v20180605
- CVE-2018-1000529Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS .Maven · org.grails.plugins:fields, org.grails:grails-core · fixed in 2.2.8, 3.3.6