Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-8152Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanismMaven · org.apache.santuario:xmlsec · fixed in 2.0.3
- CVE-2014-3628Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to injMaven · org.apache.solr:solr · fixed in 4.10.3
- CVE-2014-9527HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT Maven · org.apache.poi:poi · fixed in 3.11
- CVE-2014-7809Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protectMaven · org.apache.struts:struts2-core · fixed in 2.3.20
- CVE-2014-3627The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote Maven · org.apache.hadoop:hadoop-client · fixed in 1.0.1, 2.5.2
- CVE-2014-7816Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running Maven · io.undertow:undertow-core · fixed in 1.0.17, 1.1.0.CR5, 1.2.0.Beta3
- CVE-2014-7839DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities featureMaven · org.jboss.resteasy:resteasy-jaxrs · fixed in 3.0.11.Final
- CVE-2012-6662Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.1Maven · org.webjars.npm:jquery-ui · fixed in 1.10.0
- CVE-2014-5325The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and Maven · org.directwebremoting:dwr · fixed in 2.0.11, 3.0.RC3
- CVE-2014-5326Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to injeMaven · org.directwebremoting:dwr · fixed in 2.0.11, 3.0.RC3
- CVE-2010-5312Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to iMaven · org.webjars.npm:jquery-ui · fixed in 1.10.0
- CVE-2014-3625Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 Maven · org.springframework:spring-webmvc · fixed in 3.2.12, 4.0.8, 4.1.2
- CVE-2014-0228Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (Maven · org.apache.hive:hive, org.apache.hive:hive-exec +1 · fixed in 0.13.1
- CVE-2014-3584The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial ofMaven · org.apache.cxf:cxf-rt-frontend-jaxrs · fixed in 2.6.11, 2.7.8, 3.0.1
- CVE-2014-3623Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBindiMaven · org.apache.ws.security:wss4j, org.apache.wss4j:wss4j-ws-security-dom · fixed in 1.6.17, 2.0.2
- CVE-2014-3604Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subjecMaven · ca.juliusdavies:not-yet-commons-ssl · fixed in 0.3.15
- CVE-2013-7330Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actionMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.502, 1.480.3
- CVE-2014-2058BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbiMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2060The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vecMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.532.2, 1.551
- CVE-2014-2061The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2062Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated userMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2063Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2064The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2065Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web scriMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2066Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors invMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2068The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authentiMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-3661Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related toMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3
- CVE-2014-3662Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3
- CVE-2014-3663Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictiMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3
- CVE-2014-3666Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3