Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-6812The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page whiMaven · org.apache.cxf:cxf-core · fixed in 3.0.12, 3.1.9
- CVE-2017-9799It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possMaven · org.apache.storm:storm-core · fixed in 1.1.1, 1.0.4
- CVE-2015-4165The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code froMaven · org.elasticsearch:elasticsearch · fixed in 1.6.0
- CVE-2011-4343Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EMaven · org.apache.myfaces.core:myfaces-core-module · fixed in 2.0.11, 2.1.5
- CVE-2012-0803The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToMaven · org.apache.cxf:cxf · fixed in 2.4.6, 2.5.2
- CVE-2016-10404XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/mMaven · com.liferay.portal:release.portal.bom · fixed in 7.0.3-ga4
- CVE-2017-12645XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.Maven · com.liferay.portal:release.portal.bom · fixed in 7.0.3-ga4
- CVE-2017-12646XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.Maven · com.liferay.portal:release.portal.bom, com.liferay:com.liferay.login.authentication.openid.connect.web +1 · fixed in 7.0.3-GA4, 1.0.1, 1.1.20
- CVE-2017-12647XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.Maven · com.liferay.portal:release.portal.bom · fixed in 7.0.3-ga4
- CVE-2017-12648XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.Maven · com.liferay.portal:release.portal.bom, com.liferay:com.liferay.frontend.taglib · fixed in 7.0.3-GA4, 2.1.3
- CVE-2017-12649XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.Maven · com.liferay.portal:release.portal.bom · fixed in 7.0.3-ga4
- CVE-2017-9801When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitraMaven · org.apache.commons:commons-email · fixed in 1.5
- CVE-2015-3198The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSPMaven · org.wildfly:wildfly-parent · fixed in 9.0.0.CR2
- CVE-2017-11467OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackeMaven · com.orientechnologies:orientdb-core · fixed in 2.2.23
- CVE-2016-5394In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictivMaven · org.apache.sling:org.apache.sling.xss, org.apache.sling:org.apache.sling.xss.compat · fixed in 1.0.12, 1.1.0
- CVE-2016-6798In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the inpMaven · org.apache.sling:org.apache.sling.xss, org.apache.sling:org.apache.sling.xss.compat · fixed in 1.0.12, 1.1.0
- CVE-2017-7663Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7664Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7666Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7673Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auMaven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7680Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7681Apache OpenMeetings 1.0.0 is vulnerable to SQL injection.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7682Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7683Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7684Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7685Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-7688Apache OpenMeetings 1.0.0 updates user password in insecure manner.Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.3.0
- CVE-2017-1000034Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code executiMaven · com.typesafe.akka:akka-actor · fixed in 2.4.17
- CVE-2017-1000362The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key.Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32.2, 2.44
- CVE-2017-7672If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will Maven · org.apache.struts:struts2-core · fixed in 2.5.12