Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-6345RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.Maven · org.jboss.resteasy:resteasy-client · fixed in 3.0.20.Final, 3.1.0.CR1
- CVE-2016-6346RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.Maven · org.jboss.resteasy:resteasy-jaxrs · fixed in 3.0.20.Final
- CVE-2016-3089Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary weMaven · org.apache.openmeetings:openmeetings-parent · fixed in 3.1.2
- CVE-2016-0782The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticaMaven · org.apache.activemq:activemq-client · fixed in 5.11.4, 5.12.3, 5.13.2
- CVE-2016-5000The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an Maven · org.apache.poi:poi-examples · fixed in 3.14
- CVE-2016-5005Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary Maven · org.apache.archiva:archiva · fixed in 2.2.1
- CVE-2016-5388Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does Maven · org.apache.tomcat:tomcat-catalina · fixed in 7.0.72, 8.5.5
- CVE-2016-4974Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpatMaven · org.apache.qpid:qpid-jms-client · fixed in 0.10.0
- CVE-2016-4216XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entitMaven · com.adobe.xmp:xmpcore · fixed in 5.1.3
- CVE-2015-3192Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disableMaven · org.springframework:spring-web · fixed in 3.2.14, 4.1.7, 5.0.0.RC3
- CVE-2015-0899The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions vMaven · org.apache.struts:struts-core, struts:struts
- CVE-2016-1181ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attaMaven · org.apache.struts:struts-core, struts:struts
- CVE-2016-1182ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackeMaven · org.apache.struts:struts-core, struts:struts
- CVE-2016-3092The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x beMaven · commons-fileupload:commons-fileupload · fixed in 1.3.2
- CVE-2016-4430Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSMaven · org.apache.struts.xwork:xwork-core · fixed in 2.3.29
- CVE-2016-4431Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leMaven · org.apache.struts:struts-parent · fixed in 2.3.29
- CVE-2016-4433Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via aMaven · org.apache.struts.xwork:xwork-core · fixed in 2.3.29
- CVE-2016-4438The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.Maven · org.apache.struts:struts2-core, org.apache.struts:struts2-rest-plugin · fixed in 2.3.29
- CVE-2016-4465The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of servicMaven · org.apache.struts:struts2-core · fixed in 2.3.29, 2.5.13
- CVE-2016-2141It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster.Maven · org.jgroups:jgroups · fixed in 3.6.10.Final, 3.2.16.Final
- CVE-2016-2174SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbMaven · org.apache.ranger:ranger · fixed in 0.5.3
- CVE-2016-3670Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attacMaven · com.liferay:com.liferay.portal.search.web · fixed in 1.0.3
- CVE-2016-3720XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers Maven · com.fasterxml.jackson.dataformat:jackson-dataformat-xml · fixed in 2.7.4
- CVE-2016-3087Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackerMaven · org.apache.struts:struts2-core · fixed in 2.3.20.3, 2.3.24.3, 2.3.28.1
- CVE-2016-3093Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackMaven · ognl:ognl, org.apache.struts:struts2-core · fixed in 3.0.12, 2.3.24.3
- CVE-2015-7611Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspMaven · org.apache.james:james-server · fixed in 2.3.2.1
- CVE-2016-4437Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitMaven · org.apache.shiro:shiro-core · fixed in 1.2.5
- CVE-2016-2175Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to cMaven · org.apache.pdfbox:pdfbox · fixed in 1.8.12, 2.0.1
- CVE-2016-3088The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTMaven · org.apache.activemq:activemq-client · fixed in 5.14.0
- CVE-2016-3094PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers tMaven · org.apache.qpid:qpid-broker · fixed in 6.0.3