Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-4432The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authenticationMaven · org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol, org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol · fixed in 6.0.3
- CVE-2016-3674Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, Maven · com.thoughtworks.xstream:xstream · fixed in 1.4.9
- CVE-2016-3722Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to loMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.3
- CVE-2016-3723Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation informatMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.3
- CVE-2016-3724Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password informatioMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.3, 1.651.2
- CVE-2016-3725Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.3
- CVE-2016-3726Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary weMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.3, 1.651.2
- CVE-2016-3727The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.3, 1.651.2
- CVE-2016-3721Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.3, 1.651.2
- CVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackerMaven · org.apache.struts:struts2-core · fixed in 2.3.20.3, 2.3.24.3, 2.3.28.1
- CVE-2016-3082XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute aMaven · org.apache.struts:struts2-core · fixed in 2.3.20.3, 2.3.24.3, 2.3.28.1
- CVE-2015-1776Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials filMaven · org.apache.hadoop:hadoop-common · fixed in 2.6.5
- CVE-2015-5348Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consMaven · org.apache.camel:camel-ahc, org.apache.camel:camel-http +4 · fixed in 2.15.5, 2.16.1
- CVE-2016-0785Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced doubleMaven · org.apache.struts:struts2-core · fixed in 2.3.20.3, 2.3.24.3
- CVE-2016-2162Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackeMaven · org.apache.struts:struts2-core · fixed in 2.3.28
- CVE-2016-4003Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when usinMaven · org.apache.struts:struts2-core · fixed in 2.3.28
- CVE-2015-5167The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST APMaven · org.apache.ranger:ranger · fixed in 0.5.1
- CVE-2016-0733The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackMaven · org.apache.ranger:ranger · fixed in 0.5.1
- CVE-2016-2166The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton beforeMaven · org.apache.qpid:proton-j · fixed in 0.12.1
- CVE-2015-5349The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow aMaven · org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core · fixed in 2.0.0.v20151221-M10
- CVE-2015-0265Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary Maven · org.apache.ranger:ranger · fixed in 0.5.0
- CVE-2015-0266The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct acceMaven · org.apache.ranger:ranger · fixed in 0.5.0
- CVE-2016-0735Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraginMaven · org.apache.ranger:ranger · fixed in 0.5.2
- CVE-2016-0709Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote autMaven · org.apache.portals.jetspeed-2:jetspeed · fixed in 2.3.1
- CVE-2016-0710Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitraMaven · org.apache.portals.jetspeed-2:jetspeed · fixed in 2.3.1
- CVE-2016-0711Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script orMaven · org.apache.portals.jetspeed-2:jetspeed-commons · fixed in 2.3.1
- CVE-2016-0712Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via Maven · org.apache.portals.jetspeed-2:jetspeed · fixed in 2.3.1
- CVE-2016-0784Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenMaven · org.apache.openmeetings:openmeetings-install · fixed in 3.1.1
- CVE-2016-2163Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML Maven · org.apache.openmeetings:openmeetings-parent · fixed in 3.1.1
- CVE-2016-2164The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperlMaven · org.apache.openmeetings:openmeetings-parent · fixed in 3.1.1