Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-0788The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listeMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.650, 1.642.2
- CVE-2016-0789CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to injeMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.650, 1.642.2
- CVE-2016-0790Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attaMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.650
- CVE-2016-0791Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.650
- CVE-2016-0792Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary codeMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.650, 1.642.2
- CVE-2016-2510BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackMaven · org.apache-extras.beanshell:bsh · fixed in 2.0b6
- CVE-2016-0734The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easieMaven · org.apache.activemq:activemq-client · fixed in 5.13.2
- CVE-2016-0793Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Maven · org.wildfly:wildfly-parent, org.wildfly:wildfly-undertow · fixed in 10.0.0.Final
- CVE-2015-5174Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows reMaven · org.apache.tomcat:tomcat · fixed in 8.0.27, 7.0.65, 6.0.45
- CVE-2015-5345The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects bMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M2, 8.0.30, 7.0.68 and more
- CVE-2015-5346Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settinMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M2, 8.0.31, 7.0.66
- CVE-2015-5351The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sMaven · org.apache.tomcat:tomcat · fixed in 7.0.68, 8.0.31, 9.0.0.M2
- CVE-2016-0706Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M2, 8.0.31, 6.0.45
- CVE-2016-0714The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 misMaven · org.apache.tomcat:tomcat · fixed in 9.0.0.M2, 8.0.32, 7.0.70 and more
- CVE-2016-0763The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, andMaven · org.apache.tomcat:tomcat · fixed in 7.0.68, 8.0.32, 9.0.0.M3
- CVE-2015-8795Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary webMaven · org.apache.solr:solr-core · fixed in 5.1.0
- CVE-2015-8796Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote Maven · org.apache.solr:solr · fixed in 5.3
- CVE-2015-8797Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 aMaven · org.apache.solr:solr-core · fixed in 5.3.1
- CVE-2016-0956The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to oMaven · org.apache.sling:org.apache.sling.servlets.post · fixed in 2.3.8
- CVE-2015-5344The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via Maven · org.apache.camel:camel-xstream · fixed in 2.15.5, 2.16.1
- CVE-2015-7536Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrarMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.640, 1.625.2
- CVE-2015-7537Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.640, 1.625.2
- CVE-2015-7538Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.640, 1.625.2
- CVE-2015-7539The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site dataMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.625.2, 1.640
- CVE-2015-7521The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorMaven · org.apache.hive:hive, org.apache.hive:hive-exec +1 · fixed in 1.2.2
- CVE-2015-5254Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execuMaven · org.apache.activemq:activemq-client · fixed in 5.11.3, 5.12.2
- CVE-2015-2912The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrMaven · com.orientechnologies:orientdb-studio · fixed in 2.0.15, 2.1.1
- CVE-2015-2913server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x bMaven · com.orientechnologies:orientdb-server · fixed in 2.0.15, 2.1.1
- CVE-2015-2918The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elemeMaven · com.orientechnologies:orientdb-studio · fixed in 2.0.15, 2.1.1
- CVE-2015-1772The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.Maven · org.apache.hive:hive, org.apache.hive:hive-exec +1 · fixed in 1.0.1, 1.1.1