Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-7656In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabledMaven · org.eclipse.jetty:jetty-server · fixed in 9.3.24.v20180605, 9.4.11.v20180605
- CVE-2018-11039Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to cMaven · org.springframework:spring-web · fixed in 5.0.7, 4.3.18
- CVE-2018-11040Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable Maven · org.springframework:spring-core · fixed in 5.0.7.RELEASE, 4.3.18.RELEASE
- CVE-2018-11041Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior tMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 4.7.5, 4.10.1, 4.12.3 and more
- CVE-2018-12538In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSesMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.11.v20180605
- CVE-2018-8030A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to puMaven · org.apache.qpid:apache-qpid-broker-j · fixed in 7.1.0
- CVE-2018-12532JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapperMaven · org.richfaces:richfaces-core
- CVE-2018-12533JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitMaven · org.richfaces:richfaces-core
- CVE-2018-12432JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.Maven · net.bull.javamelody:javamelody-core · fixed in 1.61.0
- CVE-2018-12418Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an iMaven · com.github.junrar:junrar · fixed in 1.0.1
- CVE-2017-15695When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to dMaven · org.apache.geode:geode-core · fixed in 1.5.0
- CVE-2018-11688Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.Maven · org.igniterealtime.openfire:parent · fixed in 3.9.2
- CVE-2017-3199GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserializationMaven · org.graniteds:granite-core
- CVE-2017-3200The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code controlMaven · org.graniteds:granite-server-core
- CVE-2017-3202The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code controlMaven · com.exadel.flamingo.flex:amf-serializer
- CVE-2017-3203Pivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserializationMaven · org.springframework.flex:spring-flex
- CVE-2018-12036OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenaMaven · org.owasp:dependency-check-maven · fixed in 3.2.0
- CVE-2018-1000192A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.107.3, 2.121
- CVE-2018-1000193A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecuriMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.107.3, 2.121
- CVE-2018-1000194A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allowMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.107.3, 2.121
- CVE-2018-1000195A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.107.3, 2.121
- CVE-2018-1000196A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_nMaven · org.jenkins-ci.ruby-plugins:gitlab-hook
- CVE-2018-1000197An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows Maven · com.blackducksoftware.integration:blackduck-hub · fixed in 3.1.0
- CVE-2018-1000198A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that Maven · com.blackducksoftware.integration:blackduck-hub · fixed in 4.0.0
- CVE-2018-1000202A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows Maven · org.jvnet.hudson.plugins:groovy-postbuild · fixed in 2.4
- CVE-2018-1000182A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java,Maven · org.jenkins-ci.plugins:git · fixed in 3.9.1
- CVE-2018-1000183A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows atMaven · com.coravy.hudson.plugins.github:github · fixed in 1.29.1
- CVE-2018-1000184A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackerMaven · com.coravy.hudson.plugins.github:github · fixed in 1.29.1
- CVE-2018-1000185A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attacMaven · org.jenkins-ci.plugins:github-branch-source · fixed in 2.3.5
- CVE-2018-1000186A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.jMaven · org.jenkins-ci.plugins:ghprb · fixed in 1.42.0