Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-3667Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with tMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3
- CVE-2014-3679The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages.Maven · org.jvnet.hudson.plugins:monitoring · fixed in 1.53.0
- CVE-2014-3680Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for tMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3
- CVE-2014-3664Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ perMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3
- CVE-2014-3681Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web scriMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.583, 1.565.3
- CVE-2014-3678Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web Maven · org.jvnet.hudson.plugins:monitoring · fixed in 1.53.0
- CVE-2014-6439Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbMaven · org.elasticsearch:elasticsearch · fixed in 1.4.0.Beta1
- CVE-2014-1868Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a Maven · org.restlet.jse:org.restlet · fixed in 2.1.7
- CVE-2014-0168Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for reMaven · org.jolokia:jolokia-core · fixed in 1.2.1
- CVE-2014-3558ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x befoMaven · org.hibernate:hibernate-validator · fixed in 4.2.1, 4.3.2, 5.1.2
- CVE-2013-4444Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a Maven · org.apache.tomcat:tomcat · fixed in 7.0.40
- CVE-2012-6153http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a doMaven · org.apache.httpcomponents:httpclient · fixed in 4.2.3
- CVE-2014-3529The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML externalMaven · org.apache.poi:poi · fixed in 3.10.1
- CVE-2014-3574Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via aMaven · org.apache.poi:poi · fixed in 3.10.1, 3.11-beta2
- CVE-2014-3596The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's CMaven · axis:axis, org.apache.axis:axis
- CVE-2014-3577org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properlMaven · org.apache.httpcomponents:httpclient · fixed in 4.3.5
- CVE-2014-3490RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disableMaven · org.jboss.resteasy:resteasy-client · fixed in 2.3.8.SP2, 3.0.9.Final
- CVE-2014-3488The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Maven · io.netty:netty-handler · fixed in 3.9.2
- CVE-2014-3120The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expMaven · org.elasticsearch:elasticsearch · fixed in 1.4.0.Beta1
- CVE-2014-3530The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Maven · org.picketlink:picketlink-common · fixed in 2.7.0.Final
- CVE-2013-5855Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL exprMaven · org.glassfish:javax.faces · fixed in 2.2.6, 2.1.28
- CVE-2014-3503Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the pasMaven · org.apache.syncope:syncope · fixed in 1.1.8
- CVE-2014-0034The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enaMaven · org.apache.cxf:cxf-rt-ws-security · fixed in 2.6.12, 2.7.9
- CVE-2014-0035The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy Maven · org.apache.cxf:cxf-core · fixed in 2.6.13, 2.7.10
- CVE-2011-4367Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2Maven · org.apache.myfaces.core:myfaces-impl · fixed in 2.0.12, 2.1.6
- CVE-2014-3004The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External EntityMaven · castor:castor, org.codehaus.castor:castor · fixed in 1.3.3
- CVE-2014-0075Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6Maven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-coyote · fixed in 6.0.40, 7.0.53, 8.0.4
- CVE-2014-0095java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service Maven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 8.0.4
- CVE-2014-0096java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x befoMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina · fixed in 6.0.40, 7.0.54, 8.0.6
- CVE-2014-0099Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, whenMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-util · fixed in 6.0.40, 7.0.54, 8.0.6