Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-8014The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.8Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.9, 8.5.32, 8.0.53 and more
- CVE-2017-2613jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2602jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master securitMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2603Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2604In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently pMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2610jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping userMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2600In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2608Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types iMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2612In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in futuMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2018-1262Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 4.12.2, 4.13.4
- CVE-2018-1263Addresses partial fix in CVE-2018-1261.Maven · org.springframework.integration:spring-integration-zip · fixed in 1.0.2
- CVE-2018-1131Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.Maven · org.infinispan:infinispan-core · fixed in 9.3.1.Final
- CVE-2018-1257Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to exposMaven · org.springframework:spring-core · fixed in 5.0.6, 4.3.17
- CVE-2018-1258Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using metMaven · org.springframework:spring-core · fixed in 5.0.6.RELEASE
- CVE-2018-1259Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, conMaven · org.springframework.data:spring-data-commons · fixed in 1.13.12, 2.0.7
- CVE-2018-1260Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versioMaven · org.springframework.security.oauth:spring-security-oauth2 · fixed in 2.3.3, 2.2.2, 2.1.2 and more
- CVE-2018-1261Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafteMaven · org.springframework.integration:spring-integration-zip · fixed in 1.0.1
- CVE-2017-2601Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353).Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2606Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that shouMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-2611Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389).Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.44
- CVE-2017-2594hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerEMaven · io.hawt:project · fixed in 1.5.0
- CVE-2018-1000173A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorMaven · org.jenkins-ci.plugins:google-login · fixed in 1.3.1
- CVE-2018-1000174An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers tMaven · org.jenkins-ci.plugins:google-login · fixed in 1.3.1
- CVE-2018-1000175A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers ableMaven · org.jenkins-ci.plugins:htmlpublisher · fixed in 1.16
- CVE-2018-1000176An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugMaven · org.jenkins-ci.plugins:email-ext · fixed in 2.62
- CVE-2018-1000177A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjecMaven · org.jenkins-ci.plugins:s3 · fixed in 0.11.0
- CVE-2018-1256Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to Maven · io.pivotal.spring.cloud:spring-cloud-sso-connector · fixed in 2.1.3.RELEASE
- CVE-2018-1313In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a databaseMaven · org.apache.derby:derby · fixed in 10.14.2.0
- CVE-2018-10237Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks agaMaven · com.google.guava:guava, com.google.guava:guava-jdk5 +4 · fixed in 24.1.1-android
- CVE-2017-15691In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Maven · org.apache.uima:uimafit-core, org.apache.uima:uimaj-as-core +1 · fixed in 2.4.0, 2.10.2, 3.0.0-beta