Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-9787When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.Maven · org.apache.struts:struts2-core · fixed in 2.3.33, 2.5.12
- CVE-2017-7678In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting aMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 · fixed in 2.2.0
- CVE-2017-8032In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 3.6.13, 3.9.15, 3.20.0 and more
- CVE-2017-9791The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message tMaven · org.apache.struts:struts2-struts1-plugin
- CVE-2017-7660Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled.Maven · org.apache.solr:solr-core · fixed in 5.5.5, 6.6.0
- CVE-2016-4000Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.Maven · org.python:jython, org.python:jython-standalone · fixed in 2.7.1b3
- CVE-2017-7686Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional funcMaven · org.apache.ignite:ignite-core · fixed in 2.1
- CVE-2015-1778The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any usernameMaven · org.opendaylight.odlparent:opendaylight-karaf-resources · fixed in 0.2.3-Helium-SR3
- CVE-2017-9735Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain accessMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.6.v20170531, 9.3.20.v20170531, 9.2.22.v20170606
- CVE-2016-8746Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recuMaven · org.apache.ranger:ranger-plugins-common · fixed in 0.6.3
- CVE-2016-8751Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions.Maven · org.apache.ranger:ranger · fixed in 0.6.3
- CVE-2017-7676Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt.Maven · org.apache.ranger:ranger · fixed in 0.7.1
- CVE-2017-7677In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission Maven · org.apache.ranger:ranger · fixed in 0.7.1
- CVE-2017-4971An issue was discovered in Pivotal Spring Web Flow through 2.4.4.Maven · org.springframework.webflow:spring-webflow · fixed in 2.4.5
- CVE-2017-4973An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x veMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.7.4.14, 3.6.8, 3.9.10 and more
- CVE-2017-4974An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x veMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.7.4.15, 3.6.9, 3.9.11 and more
- CVE-2017-4991An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x veMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.7.4.16, 3.6.10, 3.9.12 and more
- CVE-2017-4992An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x veMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.7.4.17, 3.6.11, 3.9.13 and more
- CVE-2017-7665In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms oMaven · org.apache.nifi:nifi · fixed in 0.7.4, 1.3.0
- CVE-2017-7667Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same oriMaven · org.apache.nifi:nifi · fixed in 0.7.4, 1.3.0
- CVE-2015-5175Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.Maven · org.apache.cxf.fediz:fediz-core, org.apache.cxf.fediz:fediz-idp · fixed in 1.1.3, 1.2.1
- CVE-2016-0767PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema clasMaven · postgresql:pljava-public · fixed in 1.5.0
- CVE-2016-5004The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (Maven · org.apache.xmlrpc:xmlrpc-common
- CVE-2017-5664The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the errorMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M21, 8.5.15, 8.0.44 and more
- CVE-2017-7669In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input valiMaven · org.apache.hadoop:hadoop-common · fixed in 2.8.1, 3.0.0-alpha3
- CVE-2016-3083Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes).Maven · org.apache.hive:hive, org.apache.hive:hive-exec +1 · fixed in 1.2.2, 2.0.1
- CVE-2017-5646For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while aMaven · org.apache.knox:gateway-provider-identity-assertion-common · fixed in 0.12.0
- CVE-2014-0097The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length.Maven · org.springframework.security:spring-security-core · fixed in 3.2.2.RELEASE, 3.1.5.RELEASE
- CVE-2014-0225When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions Maven · org.springframework:spring-webmvc · fixed in 4.0.5, 3.2.8
- CVE-2014-3527When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service intMaven · org.springframework.security:spring-security-core · fixed in 3.1.7, 3.2.5