Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1297When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection.Maven · org.apache.jmeter:apachejmeter · fixed in 4.0
- CVE-2018-1000054Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with Maven · org.jvnet.hudson.plugins:ccm · fixed in 3.2
- CVE-2018-1000055Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackMaven · org.jvnet.hudson.plugins:android-lint · fixed in 2.6
- CVE-2018-1000056Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers wiMaven · org.jenkins-ci.plugins:junit · fixed in 1.24
- CVE-2018-1000057Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs.Maven · org.jenkins-ci.plugins:credentials-binding · fixed in 1.15
- CVE-2018-1000058Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods relMaven · org.jenkins-ci.plugins.workflow:workflow-support · fixed in 2.18
- CVE-2018-1307In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediatesMaven · org.apache.juddi:juddi-client · fixed in 3.3.5
- CVE-2018-1298A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocMaven · org.apache.qpid:apache-qpid-broker-j · fixed in 7.0.1
- CVE-2017-15095A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated userMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.8.11, 2.9.4, 2.6.7.3 and more
- CVE-2017-7525A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticaMaven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.6.7.1, 2.7.9.1, 2.8.9
- CVE-2018-1192In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 4.5.5, 4.7.4, 4.8.3
- CVE-2017-15706As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7Maven · org.apache.tomcat:tomcat · fixed in 9.0.2, 8.5.24, 8.0.48 and more
- CVE-2017-1000353Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.57, 2.46.2
- CVE-2017-1000354Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any JenkinMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.57, 2.46.2
- CVE-2017-1000355Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate voidMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.57, 2.46.2
- CVE-2017-1000356Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication rMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.57, 2.46.2
- CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, Maven · org.apache.poi:poi · fixed in 3.17
- CVE-2017-1000386Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown onMaven · org.biouno:uno-choice · fixed in 2.0
- CVE-2017-1000387Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publiMaven · org.jenkins-ci.plugins:build-publisher · fixed in 1.22
- CVE-2017-1000388Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency Maven · org.jenkins-ci.plugins:depgraph-view · fixed in 0.13
- CVE-2017-1000389Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters.Maven · org.jenkins-ci.plugins:global-build-stats · fixed in 1.5
- CVE-2017-1000390Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permissMaven · org.jenkins-ci.plugins:jenkins-multijob-plugin · fixed in 1.26
- CVE-2017-1000391Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as welMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.3, 2.89
- CVE-2017-1000392Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-sitMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.3, 2.89
- CVE-2017-1000393Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84
- CVE-2017-1000394Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability knMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84
- CVE-2017-1000395Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with OvMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84
- CVE-2017-1000396Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that iMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84
- CVE-2017-1000397Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrecMaven · org.jenkins-ci.main:maven-plugin · fixed in 3.0
- CVE-2017-1000398The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically buildMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84