Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-3189With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.2.5
- CVE-2015-5211Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to Maven · org.springframework:spring-core · fixed in 4.2.2, 4.1.8, 3.2.15
- CVE-2016-3084The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of LogMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 3.3.0.1
- CVE-2016-4977When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_tMaven · org.springframework.security.oauth:spring-security-oauth2 · fixed in 2.0.10, 1.0.5
- CVE-2016-5007Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization Maven · org.springframework.security:spring-security-core, org.springframework:spring-core · fixed in 4.1.1, 4.3.1
- CVE-2017-5657Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks.Maven · org.apache.archiva:archiva · fixed in 2.2.3
- CVE-2014-9970jasypt before 1.9.2 allows a timing attack against the password hash comparison.Maven · org.jasypt:jasypt · fixed in 1.9.2
- CVE-2015-5241After logging into the portal, the logout jsp page redirects the browser back to the login page after.Maven · org.apache.juddi:juddi-client · fixed in 3.2.0
- CVE-2017-7661Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications.Maven · org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9 +1 · fixed in 1.3.2, 1.2.4
- CVE-2017-7662Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application thatMaven · org.apache.cxf.fediz:fediz-oidc · fixed in 1.3.2
- CVE-2016-8741The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication.Maven · org.apache.qpid:qpid-broker · fixed in 6.0.6, 6.1.1
- CVE-2017-7957XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'voiMaven · com.thoughtworks.xstream:xstream · fixed in 1.4.10
- CVE-2017-3161The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.Maven · org.apache.hadoop:hadoop-client · fixed in 2.7.0
- CVE-2017-3162HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace.Maven · org.apache.hadoop:hadoop-client · fixed in 2.7.0
- CVE-2016-5016Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCFMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 3.3.0.3, 3.4.2
- CVE-2017-3523Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J).Maven · mysql:mysql-connector-java · fixed in 5.1.41
- CVE-2017-3586Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J).Maven · mysql:mysql-connector-java · fixed in 5.1.42
- CVE-2017-3589Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J).Maven · mysql:mysql-connector-java · fixed in 5.1.42
- CVE-2017-1000360StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql.Maven · org.opendaylight.controller:releasepom
- CVE-2017-1000361DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight.Maven · org.opendaylight.controller:releasepom
- CVE-2016-2173org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.Maven · org.springframework.amqp:spring-amqp · fixed in 1.5.5
- CVE-2016-6347Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web scriptMaven · org.jboss.resteasy:resteasy-client · fixed in 3.0.20.Final, 3.1.0.CR1
- CVE-2017-5653JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encryptMaven · org.apache.cxf:cxf-core · fixed in 3.1.11, 3.0.13
- CVE-2017-5656Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means Maven · org.apache.cxf:cxf-core · fixed in 3.1.11, 3.0.13
- CVE-2017-5661In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciouslyMaven · org.apache.xmlgraphics:fop · fixed in 2.2
- CVE-2017-5662In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send malicioMaven · org.apache.xmlgraphics:batik · fixed in 1.9
- CVE-2017-5645In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applicMaven · org.apache.logging.log4j:log4j, org.apache.logging.log4j:log4j-core · fixed in 2.8.2
- CVE-2017-5647A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to…Maven · org.apache.tomcat:tomcat · fixed in 9.0.0.M19, 8.5.13, 8.0.43 and more
- CVE-2017-5648While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.Maven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 9.0.0.M18, 8.5.13, 8.0.42 and more
- CVE-2017-5650In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams asMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M19, 8.5.13