Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1335From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands intMaven · org.apache.tika:tika-core · fixed in 1.18
- CVE-2018-1338A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.Maven · org.apache.tika:tika-core · fixed in 1.18
- CVE-2018-1339A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.Maven · org.apache.tika:tika-parsers · fixed in 1.18
- CVE-2018-1325In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.Maven · com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent · fixed in 6.29.1, 7.10.2, 8.0.0-M9.2
- CVE-2018-1274Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caMaven · org.springframework.data:spring-data-commons · fixed in 1.13.11, 2.0.6
- CVE-2017-12196undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not enMaven · io.undertow:undertow-core · fixed in 2.0.2.FInal, 1.4.24.Final
- CVE-2018-5382Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisionsMaven · org.bouncycastle:bcprov-jdk15on · fixed in 1.50
- CVE-2018-1000169An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptiMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.107.2, 2.116
- CVE-2018-1000170A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jellMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.116, 2.107.2
- CVE-2017-2599Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2018-1273Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilitMaven · org.springframework.data:spring-data-commons · fixed in 1.13.11, 2.0.6
- CVE-2018-1275Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose Maven · org.springframework:spring-messaging · fixed in 4.3.16.RELEASE, 5.0.5.RELEASE
- CVE-2018-10054H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary JMaven · com.datomic:datomic-free · fixed in 0.9.5697
- CVE-2018-1308This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlMaven · org.apache.solr:solr-core · fixed in 6.6.3, 7.3.0
- CVE-2018-1270Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose Maven · org.springframework:spring-messaging · fixed in 5.0.5.RELEASE, 4.3.16.RELEASE
- CVE-2018-1271Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configuMaven · org.springframework:spring-core · fixed in 5.0.5, 4.3.15
- CVE-2018-1272Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support fMaven · org.springframework:spring-core · fixed in 4.3.15, 5.0.5
- CVE-2018-1000142An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCauMaven · org.jenkins-ci.plugins:ghprb · fixed in 1.40.0
- CVE-2018-1000143An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCauMaven · org.jenkins-ci.plugins:ghprb · fixed in 1.32.1
- CVE-2018-1000144A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamMaven · org.jenkins-ci.plugins:cucumber-living-documentation · fixed in 1.1.0
- CVE-2018-1000145An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.jMaven · org.jvnet.hudson.plugins:perforce
- CVE-2018-1000146An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission Maven · org.jenkins-ci.plugins:liquibase-runner · fixed in 1.4.3
- CVE-2018-1000147An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.jMaven · org.jvnet.hudson.plugins:perforce
- CVE-2018-1000148An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapperMaven · org.jenkins-ci.plugins:copy-to-slave
- CVE-2018-1000149A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuildMaven · org.jenkins-ci.plugins:ansible · fixed in 1.0
- CVE-2018-1000150An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#auMaven · org.jenkins-ci.plugins:reverse-proxy-auth-plugin · fixed in 1.6.0
- CVE-2018-1000151A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validatiMaven · org.jenkins-ci.plugins:vsphere-cloud · fixed in 2.17
- CVE-2018-1000152An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertTMaven · org.jenkins-ci.plugins:vsphere-cloud · fixed in 2.17
- CVE-2018-1000153A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConveMaven · org.jenkins-ci.plugins:vsphere-cloud · fixed in 2.17
- CVE-2018-1282This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cMaven · org.apache.hive:hive-jdbc · fixed in 2.3.3