Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-9794When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to eMaven · org.apache.geode:geode-core · fixed in 1.2.1
- CVE-2016-4434Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML ExMaven · org.apache.tika:tika-core · fixed in 1.13
- CVE-2017-7687When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1Maven · org.apache.mesos:mesos · fixed in 1.1.3, 1.2.2, 1.3.1
- CVE-2017-9790When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3Maven · org.apache.mesos:mesos · fixed in 1.1.3, 1.2.2, 1.3.1
- CVE-2017-12621During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entityMaven · commons-jelly:commons-jelly · fixed in 1.0.1
- CVE-2015-5169Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.Maven · org.apache.struts:struts2-core · fixed in 2.3.20
- CVE-2017-14735OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.Maven · org.owasp.antisamy:antisamy · fixed in 1.5.7
- CVE-2015-5237protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.Maven · com.google.protobuf:protobuf-parent · fixed in 3.4.0
- CVE-2015-6748Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.Maven · org.jsoup:jsoup · fixed in 1.8.3
- CVE-2016-6795In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will beMaven · org.apache.struts:struts2-convention-plugin · fixed in 2.3.31, 2.5.5
- CVE-2016-8738In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is posMaven · org.apache.struts:struts2-core · fixed in 2.5.13
- CVE-2017-12611In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string liteMaven · org.apache.struts:struts2-core · fixed in 2.3.34, 2.5.11
- CVE-2017-9793The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerableMaven · org.apache.struts:struts2-rest-plugin · fixed in 2.3.34, 2.5.13
- CVE-2017-9804In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidaMaven · org.apache.struts:struts2-core · fixed in 2.3.34, 2.5.13
- CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.Maven · org.apache.tomcat.embed:tomcat-embed-core · fixed in 7.0.79
- CVE-2017-12616When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source codeMaven · org.apache.tomcat:tomcat-catalina · fixed in 7.0.81
- CVE-2017-9803Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-Maven · org.apache.solr:solr-core · fixed in 6.6.1
- CVE-2014-7808Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection meMaven · org.apache.wicket:wicket-core · fixed in 1.5.13, 6.19.0, 7.0.0-M5
- CVE-2017-9805The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStreaMaven · org.apache.struts:struts2-rest-plugin · fixed in 2.3.34, 2.5.13
- CVE-2017-7561Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS comMaven · org.jboss.resteasy:resteasy-jaxrs · fixed in 3.0.25.Final, 3.5.0.CR1
- CVE-2016-8737In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web sitMaven · org.apache.brooklyn:brooklyn-jsgui, org.apache.brooklyn:brooklyn-rest-resources · fixed in 0.10.0
- CVE-2016-8744Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs.Maven · org.apache.brooklyn:brooklyn · fixed in 0.10.0
- CVE-2017-12612In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket.Maven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 · fixed in 2.1.2
- CVE-2017-3165In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to ruMaven · org.apache.brooklyn:brooklyn · fixed in 0.10.0
- CVE-2014-9634Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote atMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.586
- CVE-2014-9635Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.586
- CVE-2015-3250Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.Maven · org.apache.directory.api:api-ldap-model · fixed in 1.0.0-M31
- CVE-2016-3086The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by Maven · org.apache.hadoop:hadoop-yarn-server-nodemanager · fixed in 2.6.5, 2.7.3
- CVE-2017-14063Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.neMaven · org.asynchttpclient:async-http-client · fixed in 2.0.35
- CVE-2016-5001This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HMaven · org.apache.hadoop:hadoop-common · fixed in 2.6.4, 2.7.2