Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-1000084Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication iMaven · org.jenkins-ci.plugins:parameterized-trigger · fixed in 2.35.1
- CVE-2017-1000085Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g.Maven · org.jenkins-ci.plugins:subversion · fixed in 2.9
- CVE-2017-1000086The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, triggerMaven · org.jenkins-ci.plugins:periodicbackup · fixed in 1.5
- CVE-2017-1000087GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use.Maven · org.jenkins-ci.plugins:github-branch-source · fixed in 2.2.0-alpha-1
- CVE-2017-1000088The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects.Maven · org.jenkins-ci.plugins:sidebar-link · fixed in 1.9
- CVE-2017-1000089Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Maven · org.jenkins-ci.plugins:pipeline-build-step · fixed in 2.5.1
- CVE-2017-1000090Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site RequesMaven · org.jenkins-ci.plugins:role-strategy · fixed in 2.5.1
- CVE-2017-1000091GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g.Maven · org.jenkins-ci.plugins:github-branch-source · fixed in 2.2.0-alpha-1
- CVE-2017-1000092Git Plugin connects to a user-specified Git repository as part of form validation.Maven · org.jenkins-ci.plugins:git · fixed in 3.3.2
- CVE-2017-1000093Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.Maven · org.jenkins-ci.plugins:pollscm · fixed in 1.3.1
- CVE-2017-1000094Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to Maven · org.jenkins-ci.plugins:docker-commons · fixed in 1.8
- CVE-2017-1000095The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Maven · org.jenkins-ci.plugins:script-security · fixed in 1.29.1
- CVE-2017-1000096Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in PiMaven · org.jenkins-ci.plugins.workflow:workflow-cps · fixed in 2.36.1
- CVE-2017-1000102The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: MaliciouMaven · org.jvnet.hudson.plugins:analysis-core · fixed in 1.92
- CVE-2017-1000103The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability:Maven · org.jvnet.hudson.plugins:dry · fixed in 2.49
- CVE-2017-1000104The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords.Maven · org.jenkins-ci.plugins:config-file-provider · fixed in 2.16.2
- CVE-2017-1000105The optional Run/Artifacts permission can be enabled by setting a Java system property.Maven · io.jenkins.blueocean:blueocean
- CVE-2017-1000106Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches coMaven · io.jenkins.blueocean:blueocean · fixed in 1.2.0
- CVE-2017-1000107Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invMaven · org.jenkins-ci.plugins:script-security · fixed in 1.31
- CVE-2017-1000108The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input.Maven · org.jenkins-ci.plugins:pipeline-input-step · fixed in 2.7
- CVE-2017-1000109The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripMaven · org.jenkins-ci.plugins:dependency-check-jenkins-plugin · fixed in 2.0.1.2
- CVE-2017-1000110Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches coMaven · io.jenkins.blueocean:blueocean · fixed in 1.2.0
- CVE-2017-1000113The Deploy to container Plugin stored passwords unencrypted as part of its configuration.Maven · org.jenkins-ci.plugins:deploy · fixed in 1.13
- CVE-2017-1000114The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration.Maven · org.datadog.jenkins.plugins:datadog · fixed in 0.6.2
- CVE-2017-1000118Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of ServiceMaven · com.typesafe.akka:akka-http-core_2.11, com.typesafe.akka:akka-http-core_2.12 · fixed in 10.0.6
- CVE-2017-12617When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.Maven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 9.0.1, 8.5.23, 8.0.47 and more
- CVE-2017-12620When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only aMaven · org.apache.opennlp:opennlp-tools · fixed in 1.8.2
- CVE-2014-0043In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of partiMaven · org.apache.wicket:wicket-core · fixed in 1.5.11, 6.14.0
- CVE-2016-6806Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin rMaven · org.apache.wicket:wicket-core · fixed in 6.25.0, 7.5.0, 8.0.0-M2
- CVE-2017-9797When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode aMaven · org.apache.geode:geode-core · fixed in 1.2.1