Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-5531Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors relaMaven · org.elasticsearch:elasticsearch · fixed in 1.6.1
- CVE-2014-3576The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a deMaven · org.apache.activemq:activemq-client · fixed in 5.11.0
- CVE-2015-3253The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary codeMaven · org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all · fixed in 2.4.4
- CVE-2015-1831The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application"Maven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.3.20.1
- CVE-2015-1796The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credenMaven · edu.internet2.middleware:shibboleth-identityprovider, org.opensaml:opensaml · fixed in 2.4.4, 2.6.5
- CVE-2013-7397Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a truMaven · com.ning:async-http-client · fixed in 1.9.0
- CVE-2013-7398main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require Maven · com.ning:async-http-client · fixed in 1.9.0
- CVE-2014-0230Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs beforeMaven · org.apache.tomcat:tomcat · fixed in 6.0.44, 7.0.55, 8.0.9
- CVE-2014-7810The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly cMaven · org.apache.tomcat:tomcat · fixed in 6.0.44, 7.0.58, 8.0.16
- CVE-2015-0263XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.1Maven · org.apache.camel:camel-core · fixed in 2.13.4, 2.14.2
- CVE-2015-0264Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 aMaven · org.apache.camel:camel-core · fixed in 2.13.4, 2.14.2
- CVE-2015-2944Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remotMaven · org.apache.sling:org.apache.sling.api, org.apache.sling:org.apache.sling.servlets.post · fixed in 2.2.2, 2.1.2
- CVE-2015-1833XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.Maven · org.apache.jackrabbit:jackrabbit-core · fixed in 2.0.6, 2.2.14, 2.4.6 and more
- CVE-2015-3337Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackeMaven · org.elasticsearch:elasticsearch · fixed in 1.4.5, 1.5.2
- CVE-2014-8125XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have othMaven · org.drools:drools-core, org.jbpm:jbpm-bpmn2 · fixed in 6.2.0.Final
- CVE-2015-2575Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect cMaven · mysql:mysql-connector-java · fixed in 5.1.35
- CVE-2015-0225The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMaven · org.apache.cassandra:apache-cassandra · fixed in 2.0.14, 2.1.4
- CVE-2015-0250XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote atMaven · org.apache.xmlgraphics:batik · fixed in 1.8
- CVE-2015-2351Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web scriMaven · org.opencms:opencms-core · fixed in 9.5.2
- CVE-2015-0201The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to seMaven · org.springframework:spring-core · fixed in 4.1.5
- CVE-2015-0254Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crMaven · org.apache.taglibs:taglibs-standard, org.apache.taglibs:taglibs-standard-impl · fixed in 1.2.3
- CVE-2015-0886Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to Maven · org.mindrot:jbcrypt · fixed in 0.4
- CVE-2014-8114The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafMaven · org.uberfire:uberfire-parent
- CVE-2014-3578Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrarMaven · org.springframework:spring-core · fixed in 3.2.9, 4.0.5
- CVE-2015-1427The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection meMaven · org.elasticsearch:elasticsearch · fixed in 1.3.8, 1.4.3
- CVE-2014-0227java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 doMaven · org.apache.tomcat:tomcat · fixed in 6.0.42, 7.0.55, 8.0.9
- CVE-2013-2027Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrMaven · org.python:jython-standalone · fixed in 2.7.2b3
- CVE-2014-8122Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversaMaven · org.jboss.weld:weld-core-bom · fixed in 2.2.8
- CVE-2014-8110Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remotMaven · org.apache.activemq:activemq-client · fixed in 5.10.1
- CVE-2015-0227Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via aMaven · org.apache.ws.security:wss4j, wss4j:wss4j · fixed in 1.6.17, 2.02