Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-3163When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts aMaven · org.apache.solr:solr-core · fixed in 5.5.4, 6.4.1
- CVE-2017-13763ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated.Maven · org.onosproject:onos-base · fixed in 1.11.0
- CVE-2016-8752Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointiMaven · org.apache.atlas:atlas-common · fixed in 0.8-incubating
- CVE-2017-3150Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.Maven · org.apache.atlas:atlas-common · fixed in 0.7.1-incubating
- CVE-2017-3151Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionaliMaven · org.apache.atlas:atlas-common · fixed in 0.7.1-incubating
- CVE-2017-3152Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.Maven · org.apache.atlas:atlas-common · fixed in 0.7.1-incubating
- CVE-2017-3153Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.Maven · org.apache.atlas:atlas-common · fixed in 0.7.1-incubating
- CVE-2017-3154Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.Maven · org.apache.atlas:atlas-common · fixed in 0.7.1-incubating
- CVE-2017-3155Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.Maven · org.apache.atlas:atlas-common · fixed in 0.7.1-incubating
- CVE-2015-5209Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings Maven · org.apache.struts:struts2-core · fixed in 2.3.24.1
- CVE-2015-5258Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.Maven · org.springframework.social:spring-social-core · fixed in 1.1.3.RELEASE
- CVE-2017-12972In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers Maven · com.nimbusds:nimbus-jose-jwt · fixed in 4.39
- CVE-2017-12973Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackeMaven · com.nimbusds:nimbus-jose-jwt · fixed in 4.39
- CVE-2017-12974Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curveMaven · com.nimbusds:nimbus-jose-jwt · fixed in 4.36
- CVE-2017-8446The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonaMaven · org.elasticsearch.plugin:x-pack · fixed in 5.5.2
- CVE-2017-12881Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication Maven · org.springframework.batch:spring-batch-admin-manager · fixed in 1.3.0.RELEASE
- CVE-2017-12882Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavMaven · org.springframework.batch:spring-batch-admin-manager · fixed in 1.3.0.RELEASE
- CVE-2017-7556Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their weMaven · io.hawt:project · fixed in 1.5.4
- CVE-2017-9802The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input striMaven · org.apache.sling:org.apache.sling.servlets.post · fixed in 2.3.22
- CVE-2016-6796A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 toMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M10, 8.5.5, 8.0.37 and more
- CVE-2017-7674The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary hMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M22, 8.5.16, 8.0.45 and more
- CVE-2017-7675The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented dirMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M22, 8.5.16
- CVE-2016-6797The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0Maven · org.apache.tomcat:tomcat · fixed in 9.0.0.M10, 8.5.5, 8.0.37 and more
- CVE-2016-6817The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that waMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M12, 8.5.8
- CVE-2016-8745A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RMaven · org.apache.tomcat:tomcat-util · fixed in 9.0.0.M14, 8.5.9, 8.0.41 and more
- CVE-2016-8739The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders.Maven · org.apache.cxf:cxf-core · fixed in 3.0.12, 3.1.9
- CVE-2017-3156The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signatMaven · org.apache.cxf.karaf:apache-cxf · fixed in 3.0.13, 3.1.10
- CVE-2016-0762The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to Maven · org.apache.tomcat:tomcat · fixed in 9.0.0.M10, 8.5.5, 8.0.37 and more
- CVE-2016-5018In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application Maven · org.apache.tomcat.embed:tomcat-embed-jasper, org.apache.tomcat:jasper +1 · fixed in 9.0.0.M10, 8.5.5, 8.0.37 and more
- CVE-2016-6794When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.Maven · org.apache.tomcat:tomcat · fixed in 6.0.47, 7.0.72, 8.0.37 and more