Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-0119Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parsMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina +1 · fixed in 6.0.40, 7.0.54, 8.0.6
- CVE-2013-2034Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.509.1, 1.514
- CVE-2013-6372The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSHMaven · org.jenkins-ci.plugins:subversion · fixed in 1.54
- CVE-2014-0109Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large requeMaven · org.apache.cxf:cxf-core · fixed in 2.6.14, 2.7.11
- CVE-2014-0110Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large inMaven · org.apache.cxf:cxf-core · fixed in 2.6.14, 2.7.11
- CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the geMaven · org.apache.struts:struts2-core · fixed in 2.3.20
- CVE-2014-0193WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allMaven · io.netty:netty, io.netty:netty-all · fixed in 3.6.9.Final, 3.7.1.Final, 3.8.2.Final and more
- CVE-2014-0114Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requirMaven · commons-beanutils:commons-beanutils · fixed in 1.9.4
- CVE-2013-7259Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administratMaven · org.neo4j:neo4j · fixed in 2.2.0-M01
- CVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackersMaven · org.apache.struts:struts2-core · fixed in 2.3.20
- CVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClaMaven · org.apache.struts:struts2-core · fixed in 2.3.20
- CVE-2014-1216FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RMaven · org.fitnesse:fitnesse · fixed in 20140418
- CVE-2014-0054The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entMaven · org.springframework:spring-webmvc · fixed in 3.2.8, 4.0.2
- CVE-2014-0085JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper.Maven · org.jboss.fuse:jboss-fuse · fixed in 6.1.0
- CVE-2014-0111Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Maven · org.apache.syncope:syncope · fixed in 1.0.9, 1.1.7
- CVE-2014-0107The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSMaven · xalan:xalan · fixed in 2.7.2
- CVE-2014-2741nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements,Maven · org.igniterealtime.openfire:parent · fixed in 3.9.2
- CVE-2013-2033Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x bMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.509.1, 1.514
- CVE-2014-0050MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attacMaven · commons-fileupload:commons-fileupload, org.apache.tomcat:tomcat · fixed in 1.3.1, 8.0.3, 7.0.52
- CVE-2014-0086The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial ofMaven · org.richfaces:richfaces · fixed in 5.0.0.Alpha3
- CVE-2014-0002The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have Maven · org.apache.camel:camel-core · fixed in 2.11.4, 2.12.3
- CVE-2014-0003The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execMaven · org.apache.camel:camel-core · fixed in 2.11.4, 2.12.3
- CVE-2014-1904Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.Maven · org.springframework:spring-webmvc · fixed in 3.2.8.RELEASE, 4.0.2.RELEASE
- CVE-2014-0094The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, Maven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.3.16.2
- CVE-2014-2059Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2014-2067Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.551, 1.532.2
- CVE-2013-4286Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properlyMaven · org.apache.tomcat:tomcat · fixed in 6.0.39, 7.0.47, 8.0.0-RC3
- CVE-2013-4322Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a Maven · org.apache.tomcat:tomcat · fixed in 6.0.39, 7.0.50, 8.0.0-RC10
- CVE-2013-4590Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leverMaven · org.apache.tomcat:tomcat · fixed in 6.0.39, 7.0.50, 8.0.0-RC10
- CVE-2014-0033org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting whMaven · org.apache.tomcat:tomcat · fixed in 6.0.38