Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-5651In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file Maven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 9.0.0.M19, 8.5.13
- CVE-2016-7051XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers tMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-xml · fixed in 2.7.8, 2.8.4
- CVE-2016-4800The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protMaven · org.eclipse.jetty:jetty-server · fixed in 9.3.9
- CVE-2016-4970handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of Maven · io.netty:netty-handler · fixed in 4.0.37.Final, 4.1.1.Final
- CVE-2016-6348JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.Maven · org.jboss.resteasy:resteasy-client · fixed in 3.0.20.Final
- CVE-2016-6811In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.Maven · org.apache.hadoop:hadoop-common · fixed in 2.7.4
- CVE-2016-6805Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.Maven · org.apache.ignite:ignite-core · fixed in 1.9
- CVE-2016-6809Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files.Maven · org.apache.tika:tika-core · fixed in 1.14
- CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x beforeMaven · org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina-jmx-remote · fixed in 6.0.48, 7.0.73, 8.0.39 and more
- CVE-2017-5649Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users wMaven · org.apache.geode:geode-core · fixed in 1.1.1
- CVE-2015-1611OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related toMaven · org.opendaylight.openflowplugin:openflowplugin · fixed in 0.0.6-Helium-SR3
- CVE-2015-1612OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related toMaven · org.opendaylight.openflowplugin:openflowplugin · fixed in 0.0.6-Helium-SR3
- CVE-2016-4976Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitiveMaven · org.apache.ambari:ambari · fixed in 2.4.0
- CVE-2016-6807Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operatiMaven · org.apache.ambari:ambari · fixed in 2.4.2
- CVE-2016-8749Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.Maven · org.apache.camel:camel-jackson · fixed in 2.16.5, 2.17.5, 2.18.2
- CVE-2017-5644Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted Maven · org.apache.poi:poi · fixed in 3.15
- CVE-2014-0229Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1)Maven · org.apache.hadoop:hadoop-common · fixed in 0.23.11, 2.4.1
- CVE-2016-6816The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HMaven · org.apache.tomcat:tomcat-coyote · fixed in 9.0.0.M12, 8.5.8, 8.0.39 and more
- CVE-2017-5617The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgeMaven · com.kitfox.svg:svg-salamander · fixed in 1.1.2
- CVE-2017-5643Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.Maven · org.apache.camel:camel-core · fixed in 2.17.6, 2.18.2
- CVE-2016-7103Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via Maven · org.webjars.npm:jquery-ui · fixed in 1.12.0
- CVE-2016-8747An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations.Maven · org.apache.tomcat:tomcat · fixed in 8.5.10, 9.0.0.M16
- CVE-2017-5929QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.Maven · ch.qos.logback:logback-classic, ch.qos.logback:logback-core · fixed in 1.2.0
- CVE-2017-5638The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mesMaven · org.apache.struts:struts2-core · fixed in 2.3.32, 2.5.10.1
- CVE-2017-4960An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 3.12.0, 3.9.8
- CVE-2017-3159Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability.Maven · org.apache.camel:camel-snakeyaml · fixed in 2.17.5, 2.18.2
- CVE-2016-4314Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbMaven · org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui
- CVE-2016-4316Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via tMaven · org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui, org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui +1
- CVE-2016-3101Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web Maven · org.jenkins-ci.plugins:extra-columns · fixed in 1.17
- CVE-2016-3102The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugiMaven · org.jenkins-ci.plugins:script-security · fixed in 1.18.1