Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2012-0881Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an Maven · xerces:xercesimpl · fixed in 2.12.0
- CVE-2014-0115Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a ..Maven · org.apache.storm:storm
- CVE-2014-3526Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vecMaven · org.apache.wicket:wicket-core · fixed in 1.5.12, 6.17.0, 7.0.0-M3
- CVE-2015-0226Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key orMaven · org.apache.ws.security:wss4j, org.apache.wss4j:wss4j-ws-security-dom · fixed in 1.6.17, 2.0.2
- CVE-2016-3090The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a craftMaven · org.apache.struts:struts2-parent · fixed in 2.3.20
- CVE-2014-3579XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via veMaven · org.apache.activemq:apollo-project · fixed in 1.7.1
- CVE-2014-3600XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors Maven · org.apache.activemq:activemq-broker, org.apache.activemq:activemq-client · fixed in 5.10.1
- CVE-2016-5002XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackMaven · org.apache.xmlrpc:xmlrpc
- CVE-2016-5003The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a craftedMaven · org.apache.xmlrpc:xmlrpc
- CVE-2017-12158It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.Maven · org.keycloak:keycloak-parent · fixed in 3.4.0
- CVE-2017-12159It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.Maven · org.keycloak:keycloak-parent · fixed in 3.4.0
- CVE-2017-12160It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serveMaven · org.keycloak:keycloak-parent · fixed in 3.3.0.Final
- CVE-2017-15911The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who clicMaven · org.igniterealtime.openfire:parent · fixed in 4.1.7
- CVE-2015-5170Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.5.2
- CVE-2015-5171The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.5.2
- CVE-2015-5172Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.5.2
- CVE-2010-2232In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.Maven · org.apache.derby:derby · fixed in 10.4.2.0
- CVE-2017-12628The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be uMaven · org.apache.james:james-project · fixed in 3.0.1
- CVE-2016-8748In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessedMaven · org.apache.nifi:nifi · fixed in 1.0.1, 1.1.1
- CVE-2017-5635In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the oMaven · org.apache.nifi:nifi · fixed in 0.7.2, 1.1.2
- CVE-2017-5636In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to anMaven · org.apache.nifi:nifi · fixed in 0.7.2, 1.1.2
- CVE-2015-2156Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before Maven · io.netty:netty, io.netty:netty-parent +1 · fixed in 3.10.3.Final, 3.9.8.Final, 4.0.28.Final
- CVE-2014-3709The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cMaven · org.keycloak:keycloak-services · fixed in 1.0.3.Final
- CVE-2016-4461Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced doubleMaven · org.apache.struts:struts2-core · fixed in 2.3.29
- CVE-2017-12629Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config AMaven · org.apache.solr:solr-core · fixed in 7.1.0, 6.6.2, 5.5.5
- CVE-2016-6815In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.Maven · org.apache.ranger:ranger · fixed in 0.6.2
- CVE-2016-8736Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.1.2
- CVE-2017-10862jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWMaven · io.really:jwt-scala
- CVE-2017-12623An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attaMaven · org.apache.nifi:nifi · fixed in 1.4.0
- CVE-2017-5637Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, wMaven · org.apache.zookeeper:zookeeper · fixed in 3.4.10, 3.5.3