Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-1836Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.Maven · org.apache.hbase:hbase · fixed in 0.98.12.1, 1.0.1.1, 1.1.0.1
- CVE-2015-6420Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, SerMaven · commons-collections:commons-collections, net.sourceforge.collections:collections-generic +3 · fixed in 3.2.2, 4.1
- CVE-2014-3665Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote atMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.587
- CVE-2015-5317The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name inMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.625.2, 1.638
- CVE-2015-5318Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for reMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.625.2, 1.638
- CVE-2015-5319XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackersMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.638, 1.625.2
- CVE-2015-5320Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.638, 1.625.2
- CVE-2015-5321The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.638, 1.625.2
- CVE-2015-5322Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and readMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.638, 1.625.2
- CVE-2015-5323Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain prMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.625.2, 1.638
- CVE-2015-5324Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.638, 1.625.2
- CVE-2015-5325Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slavMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.625.2, 1.638
- CVE-2015-5326Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticatMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.625.2, 1.638
- CVE-2015-8103The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serMaven · org.jenkins-ci.main:cli · fixed in 1.625.2, 1.638
- CVE-2015-5253The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass Maven · org.apache.cxf:cxf-rt-rs-security-sso-saml · fixed in 2.7.18, 3.0.7, 3.1.3
- CVE-2015-7940The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackeMaven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 +1 · fixed in 1.51
- CVE-2015-1775Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticaMaven · org.apache.ambari:ambari · fixed in 2.1.0
- CVE-2015-5210Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishMaven · org.apache.ambari:ambari · fixed in 2.1.2
- CVE-2015-5262http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configurationMaven · org.apache.httpcomponents:httpclient · fixed in 4.3.6
- CVE-2015-1806The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configurationMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.600, 1.596.1
- CVE-2015-1808Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool instalMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.600, 1.596.1
- CVE-2015-1810The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using thMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.600, 1.596.1
- CVE-2015-1812Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web scriMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.596.2, 1.606
- CVE-2015-1813Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web scriMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.606, 1.596.2
- CVE-2015-1814The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API toMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.606, 1.596.2
- CVE-2015-3158The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not propMaven · org.picketlink:picketlink-tomcat-common · fixed in 2.7.1.Final
- CVE-2014-3612The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows rMaven · org.apache.activemq:activemq-broker, org.apache.activemq:activemq-jaas · fixed in 5.10.1
- CVE-2015-6524The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wMaven · org.apache.activemq:activemq-broker, org.apache.activemq:activemq-jaas · fixed in 5.10.2
- CVE-2014-1972Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remMaven · org.apache.tapestry:tapestry-core · fixed in 5.3.6
- CVE-2015-1830Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 forMaven · org.apache.activemq:activemq-client · fixed in 5.11.2