Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-1000399The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically bMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84
- CVE-2017-1000400The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projeMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84
- CVE-2017-1000401The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validatiMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.73.2, 2.84
- CVE-2017-1000402Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that inMaven · org.jenkins-ci.plugins:swarm-client, org.jvnet.hudson.plugins:swarm-plugin · fixed in 3.5
- CVE-2017-1000403Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVMMaven · org.jvnet.hudson.plugins:speaks
- CVE-2017-1000404The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScrMaven · se.diabol.jenkins.pipeline:delivery-pipeline-plugin · fixed in 1.0.8
- CVE-2017-15703Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and cauMaven · org.apache.nifi:nifi-framework-cluster-protocol · fixed in 1.5.0
- CVE-2018-1051It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possibleMaven · org.jboss.resteasy:resteasy-yaml-provider · fixed in 3.0.26.Final, 3.6.0.Final
- CVE-2017-1000505In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a tMaven · org.jenkins-ci.plugins:script-security · fixed in 1.37
- CVE-2017-1000502Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commandsMaven · org.jenkins-ci.plugins:ec2 · fixed in 1.38
- CVE-2017-1000503A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands durinMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.89.2, 2.95
- CVE-2017-1000504A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands duringMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.89.2, 2.95
- CVE-2018-1047A flaw was found in Wildfly 9.x.Maven · org.wildfly:wildfly-undertow · fixed in 12.0.0
- CVE-2018-1048It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus alloMaven · org.jboss.eap:wildfly-undertow · fixed in 7.1.1.GA
- CVE-2017-15718The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN ApMaven · org.apache.hadoop:hadoop-main · fixed in 2.7.5
- CVE-2017-12632A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server.Maven · org.apache.nifi:nifi · fixed in 1.5.0
- CVE-2017-15697A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code executioMaven · org.apache.nifi:nifi · fixed in 1.5.0
- CVE-2018-1000008Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers withMaven · org.jvnet.hudson.plugins:pmd · fixed in 3.50
- CVE-2018-1000009Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackeMaven · org.jvnet.hudson.plugins:checkstyle · fixed in 3.50
- CVE-2018-1000010Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers withMaven · org.jvnet.hudson.plugins:dry · fixed in 2.50
- CVE-2018-1000011Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackersMaven · org.jvnet.hudson.plugins.findbugs:library
- CVE-2018-1000012Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackersMaven · org.jvnet.hudson.plugins:warnings · fixed in 4.65
- CVE-2018-1000013Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowingMaven · org.jenkins-ci.plugins:release · fixed in 2.10
- CVE-2018-1000014Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerMaven · org.jenkins-ci.plugins:translation · fixed in 1.16
- CVE-2018-1000015On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on somMaven · org.jenkins-ci.plugins.workflow:workflow-durable-task-step · fixed in 2.18
- CVE-2018-5968FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.8.11.1, 2.9.4, 2.7.9.5
- CVE-2017-15713Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to exMaven · org.apache.hadoop:hadoop-main · fixed in 2.7.5, 2.8.3
- CVE-2012-6708jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.Maven · org.webjars.npm:jquery · fixed in 1.9.0
- CVE-2015-9251jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType oMaven · org.webjars.npm:jquery · fixed in 1.12.2, 3.0.0
- CVE-2016-10707jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.Maven · org.webjars.npm:jquery · fixed in 3.0.0