Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1000187A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that reMaven · org.csanchez.jenkins.plugins:kubernetes · fixed in 1.7.1
- CVE-2018-1000188A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers withMaven · org.jenkins-ci.plugins:cas-plugin · fixed in 1.4.2
- CVE-2018-1000189A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with OvMaven · org.jenkins-ci.plugins:absint-astree · fixed in 1.0.7
- CVE-2018-1000190A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java thMaven · com.blackducksoftware.integration:blackduck-hub · fixed in 4.0.1
- CVE-2018-1000191A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptoMaven · com.synopsys.integration:synopsys-detect · fixed in 1.4.1
- CVE-2018-1332Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to iMaven · org.apache.storm:storm-core · fixed in 1.1.3, 1.2.2
- CVE-2018-8008Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that Maven · org.apache.storm:storm-core · fixed in 1.1.3, 1.2.2, 1.0.7
- CVE-2018-1000180Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, speciMaven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.60
- CVE-2016-1000344In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000345In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000346In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000352In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000339In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000340In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for severaMaven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000341In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000342In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2016-1000343In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default valuMaven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2018-11650Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.Maven · org.graylog2:graylog2-server · fixed in 2.4.4
- CVE-2018-11651Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, compoMaven · org.graylog2:graylog2-server · fixed in 2.4.4
- CVE-2016-1000338In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.56
- CVE-2018-8013In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the claMaven · org.apache.xmlgraphics:batik · fixed in 1.10
- CVE-2018-1309Apache NiFi External XML Entity issue in SplitXML processor.Maven · org.apache.nifi:nifi-standard-processors · fixed in 1.6.0
- CVE-2018-1310Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability.Maven · org.apache.nifi:nifi · fixed in 1.6.0
- CVE-2017-2598Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2609jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385).Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2607jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382).Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2018-8010This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solMaven · org.apache.solr:solr-core · fixed in 6.6.4, 7.3.1
- CVE-2018-8012No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha throuMaven · org.apache.zookeeper:zookeeper · fixed in 3.4.10, 3.5.4-beta
- CVE-2018-1067In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerMaven · org.jboss.eap:wildfly-undertow · fixed in 7.1.2.GA
- CVE-2018-8015In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser.Maven · org.apache.orc:orc · fixed in 1.4.4