Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1000109An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildSteMaven · org.jenkins-ci.plugins:google-play-android-publisher · fixed in 1.7
- CVE-2018-1000110An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker witMaven · org.jenkins-ci.plugins:git · fixed in 3.8.0
- CVE-2018-1000111An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversiMaven · org.jenkins-ci.plugins:subversion · fixed in 2.10.3
- CVE-2018-1000112An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an atMaven · org.jenkins-ci.plugins:mercurial · fixed in 2.3
- CVE-2018-1000113A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others thatMaven · org.jenkins-ci.plugins:testlink · fixed in 2.13
- CVE-2018-1000114An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java Maven · org.jenkins-ci.plugins:promoted-builds · fixed in 3.0
- CVE-2016-8629Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rMaven · org.keycloak:keycloak-core · fixed in 2.4.0
- CVE-2016-9589Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service.Maven · org.wildfly:wildfly-undertow · fixed in 11.0.0.Beta1
- CVE-2017-2585Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constantMaven · org.keycloak:keycloak-core · fixed in 2.5.1
- CVE-2017-15719In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG ediMaven · com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent · fixed in 6.28.1, 7.9.2, 8.0.0-M8.1
- CVE-2016-9606JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrMaven · org.jboss.resteasy:resteasy-bom · fixed in 3.1.2.Final
- CVE-2017-12174It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is createdMaven · org.apache.activemq:artemis-native, org.hornetq:hornetq-server · fixed in 2.4.0, 2.4.0.Final
- CVE-2018-1316The ODE process deployment web service was sensible to deployment messages with forged names.Maven · org.apache.ode:ode · fixed in 1.3.3
- CVE-2018-1304The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.5, 8.5.28, 8.0.51 and more
- CVE-2018-1286In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to dMaven · org.apache.openmeetings:openmeetings-parent · fixed in 4.0.2
- CVE-2012-3536Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project.Maven · org.apache.james.hupa:hupa-parent · fixed in 0.0.3
- CVE-2017-15692In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data.Maven · org.apache.geode:geode-core · fixed in 1.4.0
- CVE-2017-15693In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form.Maven · org.apache.geode:geode-core · fixed in 1.4.0
- CVE-2018-7489FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution becauseMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.8.11.1, 2.9.5, 2.7.9.3 and more
- CVE-2017-15696When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configurMaven · org.apache.geode:geode-core · fixed in 1.4.0
- CVE-2018-1305Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 tMaven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 9.0.5, 8.5.28, 7.0.85
- CVE-2017-12161It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset requeMaven · org.keycloak:keycloak-core · fixed in 3.4.2
- CVE-2018-6356Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.89.4, 2.107
- CVE-2016-8750Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP.Maven · org.apache.karaf:apache-karaf · fixed in 4.0.8
- CVE-2017-15712Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process.Maven · org.apache.oozie:oozie-core · fixed in 5.0.0
- CVE-2018-1000067An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker toMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.89.4, 2.107
- CVE-2018-1000068An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attackerMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.89.4, 2.107
- CVE-2017-15089It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.Maven · org.infinispan:infinispan-core · fixed in 9.2.0.CR1
- CVE-2018-1287In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host.Maven · org.apache.jmeter:apachejmeter · fixed in 4.0
- CVE-2017-15709When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel vMaven · org.apache.activemq:activemq-openwire-generator, org.apache.activemq:activemq-parent · fixed in 5.15.3, 5.14.6