Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-12197It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating.Maven · org.kohsuke:libpam4j · fixed in 1.10
- CVE-2017-3158A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data tMaven · org.apache.guacamole:guacamole-common · fixed in 0.9.11-incubating
- CVE-2016-6814When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standarMaven · org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all · fixed in 2.4.8
- CVE-2017-17485FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.9.4, 2.8.11, 2.7.9.2
- CVE-2016-6810In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based admiMaven · org.apache.activemq:activemq-client · fixed in 5.14.2
- CVE-2017-7536In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whiMaven · org.hibernate:hibernate-validator · fixed in 5.2.5.Final, 5.3.6.Final, 5.4.2.Final
- CVE-2017-7559In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 wMaven · io.undertow:undertow-core · fixed in 1.4.17.Final, 1.3.31.Final, 2.0.0.Alpha2
- CVE-2017-15717A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilMaven · org.apache.sling:org.apache.sling.xss, org.apache.sling:org.apache.sling.xss.compat · fixed in 2.0.4
- CVE-2017-12622When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh Maven · org.apache.geode:geode-core · fixed in 1.3.0
- CVE-2017-9795When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster mMaven · org.apache.geode:geode-core · fixed in 1.3.0
- CVE-2017-9796When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster mMaven · org.apache.geode:geode-core · fixed in 1.3.0
- CVE-2012-3353The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files iMaven · org.apache.sling:org.apache.sling.jcr.contentloader · fixed in 2.1.6
- CVE-2014-3607DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subjecMaven · edu.internet2.middleware:shibboleth-identityprovider, edu.vt.middleware:vt-ldap · fixed in 2.4.2, 3.3.8
- CVE-2017-17837The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling.Maven · org.apache.deltaspike.modules:jsf-module-project · fixed in 1.8.1
- CVE-2017-8046Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1Maven · org.springframework.data:spring-data-rest-core · fixed in 2.6.9.RELEASE, 3.0.1.RELEASE
- CVE-2018-1190An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 3.20.2
- CVE-2017-1000486Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code executionMaven · org.primefaces:primefaces · fixed in 6.0
- CVE-2017-1000487Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.Maven · org.codehaus.plexus:plexus-utils · fixed in 3.0.16
- CVE-2017-1000498AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code eMaven · com.caverock:androidsvg · fixed in 1.3
- CVE-2017-1000425Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers tMaven · com.liferay.portal:release.portal.bom · fixed in 7.1.0-a1
- CVE-2014-3651JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size Maven · org.keycloak:keycloak-core · fixed in 1.0.3
- CVE-2017-5641Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by Maven · org.apache.flex.blazeds:flex-messaging-core, org.apache.flex.blazeds:flex-messaging-remoting · fixed in 4.7.3
- CVE-2017-15700A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, thMaven · org.apache.sling:org.apache.sling.auth.core · fixed in 1.4.2
- CVE-2017-12630In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effeMaven · org.apache.drill:drill-common · fixed in 1.12.0
- CVE-2017-13098BouncyCastle JCE TLS Bleichenbacher/ROBOTMaven · org.bouncycastle:bcprov-jdk15on · fixed in 1.0.3
- CVE-2017-15708In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI).Maven · org.apache.synapse:synapse-core · fixed in 3.0.1
- CVE-2017-17383Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.94
- CVE-2017-15707In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack usiMaven · org.apache.struts:struts2-rest-plugin · fixed in 2.5.16
- CVE-2017-15701In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frameMaven · org.apache.qpid:qpid-broker · fixed in 6.1.5
- CVE-2017-15702In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of whiMaven · org.apache.qpid:qpid-broker · fixed in 6.0.0