Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-1000406OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cacheMaven · org.opendaylight.integration:distribution-karaf
- CVE-2017-14868Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a RESTMaven · org.restlet.jse:org.restlet.ext.jaxrs · fixed in 2.3.11
- CVE-2017-14949Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE aMaven · org.restlet.jse:org.restlet · fixed in 2.3.12
- CVE-2017-12631Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications.Maven · org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2 +1 · fixed in 1.3.3, 1.4.3
- CVE-2017-1000207A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary cMaven · io.swagger:swagger-codegen, io.swagger:swagger-parser · fixed in 2.2.2, 1.0.31
- CVE-2017-4995An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1.Maven · org.springframework.security:spring-security-core · fixed in 4.2.3.RELEASE, 5.0.0.M2
- CVE-2017-8028In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using Maven · org.springframework.ldap:spring-ldap-core · fixed in 2.3.2
- CVE-2017-8031An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versiMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 4.7.1, 4.5.3, 3.20.1
- CVE-2017-8039An issue was discovered in Pivotal Spring Web Flow through 2.4.5.Maven · org.springframework.webflow:spring-webflow · fixed in 2.4.6
- CVE-2017-8045In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized wheMaven · org.springframework.amqp:spring-amqp · fixed in 1.5.7, 1.6.11, 1.7.4
- CVE-2017-1000217Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting inMaven · org.opencastproject:base · fixed in 2.3.3
- CVE-2017-1000221In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will haMaven · org.opencastproject:opencast-kernel · fixed in 2.2.4
- CVE-2017-1000190SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.Maven · org.simpleframework:simple-xml · fixed in 2.7.1
- CVE-2017-1000208A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciousMaven · io.swagger:swagger-codegen, io.swagger:swagger-parser · fixed in 2.2.2, 1.0.31
- CVE-2017-1000209The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CMaven · com.neovisionaries:nv-websocket-client · fixed in 2.1
- CVE-2014-0219Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdowMaven · org.apache.karaf:apache-karaf · fixed in 4.0.10
- CVE-2017-15288The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tMaven · org.scala-lang:scala-compiler · fixed in 2.10.7, 2.11.12, 2.12.4
- CVE-2017-12633The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulneraMaven · org.apache.camel:camel-hessian · fixed in 2.19.4, 2.20.1
- CVE-2017-12634The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerabMaven · org.apache.camel:camel-castor · fixed in 2.19.4, 2.20.1
- CVE-2017-12624Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications.Maven · org.apache.cxf:cxf-core · fixed in 3.2.1, 3.1.14, 3.0.16
- CVE-2017-3166In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that makMaven · org.apache.hadoop:hadoop-main · fixed in 2.7.3
- CVE-2015-7501Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise AppliMaven · commons-collections:commons-collections, net.sourceforge.collections:collections-generic +3 · fixed in 3.2.2, 4.1
- CVE-2017-9096The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct Maven · com.itextpdf:itextpdf, com.lowagie:itext · fixed in 5.5.12, 7.0.3
- CVE-2017-1000242Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosureMaven · org.jenkins-ci.plugins:git-client · fixed in 2.4.3
- CVE-2017-1000243Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any otherMaven · org.jvnet.hudson.plugins:favorite · fixed in 2.3.0
- CVE-2017-1000244Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modificationMaven · org.jvnet.hudson.plugins:favorite · fixed in 2.3.2
- CVE-2017-1000245The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol.Maven · org.jenkins-ci.plugins:ssh, org.jvnet.hudson.plugins:ssh · fixed in 2.5
- CVE-2017-12625Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be definedMaven · org.apache.hive:hive, org.apache.hive:hive-exec +1 · fixed in 2.1.2, 2.2.1, 2.3.1
- CVE-2012-4449Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security feMaven · org.apache.hadoop:hadoop-client · fixed in 0.23.4, 1.0.4, 2.0.2
- CVE-2013-4366http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, whichMaven · org.apache.httpcomponents:httpclient · fixed in 4.3.1