Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-4986Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecifieMaven · org.tap4j:tap · fixed in 1.25
- CVE-2016-4987Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories anMaven · com.tupilabs.image_gallery:image-gallery · fixed in 1.4
- CVE-2016-4988Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbMaven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 1.16.0
- CVE-2016-2402OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain witMaven · com.squareup.okhttp3:okhttp · fixed in 2.7.4, 3.1.2
- CVE-2016-5725Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP serverMaven · com.jcraft:jsch · fixed in 0.1.54
- CVE-2010-5327Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.Maven · com.liferay.portal:portal-impl, com.liferay.portal:portal-service · fixed in 6.2.11
- CVE-2015-3188The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.Maven · org.apache.storm:storm · fixed in 0.10.0-beta1
- CVE-2016-10027Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle Maven · org.igniterealtime.smack:smack-core · fixed in 4.1.9
- CVE-2016-9299The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.32, 2.19.3
- CVE-2016-9879An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1.Maven · org.springframework.security:spring-security-core · fixed in 3.2.10.RELEASE, 4.1.4.RELEASE, 4.2.1.RELEASE
- CVE-2016-9878An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5.Maven · org.springframework:spring-webmvc · fixed in 3.2.18, 4.2.9, 4.3.5
- CVE-2016-10006In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass thMaven · org.owasp.antisamy:antisamy · fixed in 1.5.5
- CVE-2015-3271Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.Maven · org.apache.tika:tika-server · fixed in 1.10
- CVE-2016-5393In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitMaven · org.apache.hadoop:hadoop-common · fixed in 2.6.5, 2.7.3
- CVE-2016-9177Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a ..Maven · com.sparkjava:spark-core · fixed in 2.5.2
- CVE-2016-1000031Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code ExecutionMaven · commons-fileupload:commons-fileupload · fixed in 1.3.3
- CVE-2015-2080The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memMaven · org.eclipse.jetty:jetty-server · fixed in 9.2.9.v20150224
- CVE-2016-6652SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a reMaven · org.springframework.data:spring-data-jpa · fixed in 1.9.6, 1.10.4
- CVE-2015-1832XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in placMaven · org.apache.derby:derby · fixed in 10.12.1.1
- CVE-2016-7046Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers Maven · io.undertow:undertow-core · fixed in 1.4.3.Final, 1.3.25.Final
- CVE-2016-5019CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 miMaven · org.apache.myfaces.trinidad:trinidad · fixed in 1.2.15, 2.0.2, 2.1.2
- CVE-2016-4436Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name Maven · org.apache.struts:struts2-core · fixed in 2.3.29, 2.5.1
- CVE-2016-6637Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3Maven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 2.7.4.7, 3.3.0.5, 3.4.4 and more
- CVE-2016-4978The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Maven · org.apache.activemq:artemis-pom · fixed in 1.4.0
- CVE-2016-3110mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via anMaven · org.jboss.mod_cluster:mod_cluster-parent · fixed in 1.3.3.Final
- CVE-2016-4993CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.Maven · org.wildfly:wildfly-undertow · fixed in 11.0.0.Final
- CVE-2016-5395Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remoMaven · org.apache.ranger:ranger · fixed in 0.6.1
- CVE-2016-4464The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against cMaven · org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2 · fixed in 1.2.3, 1.3.1
- CVE-2016-6801Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6,Maven · org.apache.jackrabbit:jackrabbit-webdav · fixed in 2.4.6, 2.6.6, 2.8.3 and more
- CVE-2016-6802Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet contexMaven · org.apache.shiro:shiro-all, org.apache.shiro:shiro-web · fixed in 1.3.2