Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1284In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_floMaven · org.apache.hive:hive, org.apache.hive:hive-exec +1 · fixed in 2.3.3
- CVE-2018-1315In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server canMaven · org.apache.hive:hive, org.apache.hive:hive-exec +1 · fixed in 2.3.3
- CVE-2018-1295In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, whicMaven · org.apache.ignite:ignite-core · fixed in 2.4
- CVE-2018-9159In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as Maven · com.sparkjava:spark-core · fixed in 2.7.2
- CVE-2018-1327The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request witMaven · org.apache.struts:struts2-rest-plugin · fixed in 2.5.16
- CVE-2018-8718Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthMaven · org.jenkins-ci.plugins:mailer · fixed in 1.21
- CVE-2018-1229Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature.Maven · org.springframework.batch:spring-batch-admin-manager
- CVE-2018-1294If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and thatMaven · org.apache.commons:commons-email · fixed in 1.5
- CVE-2018-1321An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1Maven · org.apache.syncope:syncope-core · fixed in 1.2.11, 2.0.8
- CVE-2018-1322An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x andMaven · org.apache.syncope:syncope-core · fixed in 1.2.11, 2.0.8
- CVE-2018-8088org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restricMaven · org.slf4j:slf4j-ext · fixed in 1.7.26, 1.8.0-beta4
- CVE-2018-1196Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service.Maven · org.springframework.boot:spring-boot · fixed in 1.5.10
- CVE-2017-18239A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala inMaven · com.jason-goodwin:authentikat-jwt_2.12 · fixed in 0.4.6
- CVE-2018-1199Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 anMaven · org.springframework.security:spring-security-core, org.springframework:spring-core · fixed in 4.2.4, 5.0.1, 4.1.5 and more
- CVE-2018-1000134UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, whereMaven · com.unboundid:unboundid-ldapsdk · fixed in 4.0.5
- CVE-2018-1324A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFMaven · com.liferay:com.liferay.portal.tools.bundle.support, io.takari:commons-compress +1 · fixed in 3.7.4, 1.16
- CVE-2018-1000129An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript iMaven · org.jolokia:jolokia-core · fixed in 1.5.0
- CVE-2018-1000130A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java cMaven · org.jolokia:jolokia-core · fixed in 1.5.0
- CVE-2018-1000073RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesMaven · org.jruby:jruby-stdlib · fixed in 9.1.16.0
- CVE-2018-1000074RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesMaven · org.jruby:jruby-stdlib · fixed in 9.1.16.0
- CVE-2018-1000075RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesMaven · org.jruby:jruby-stdlib · fixed in 9.1.16.0
- CVE-2018-1000076RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesMaven · org.jruby:jruby-stdlib · fixed in 9.1.16.0
- CVE-2018-1000077RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesMaven · org.jruby:jruby-stdlib · fixed in 9.1.16.0
- CVE-2018-1000078RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesMaven · org.jruby:jruby-stdlib · fixed in 9.1.16.0
- CVE-2018-1000079RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesMaven · org.jruby:jruby-stdlib · fixed in 9.1.16.0
- CVE-2018-1000104A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attaMaven · org.jenkins-ci.plugins:coverity · fixed in 1.11.0
- CVE-2018-1000105An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.jaMaven · com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger · fixed in 2.27.5
- CVE-2018-1000106An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.jaMaven · com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger · fixed in 2.27.5
- CVE-2018-1000107An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobMaven · com.synopsys.jenkinsci:ownership · fixed in 0.12.0
- CVE-2018-1000108A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attMaven · org.jenkins-ci.plugins:cppncss · fixed in 1.2