Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-6440The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set tMaven · org.opensaml:opensaml · fixed in 2.6.1
- CVE-2013-1880Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 alloMaven · org.apache.activemq:activemq-core · fixed in 5.9.0
- CVE-2013-6235Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbMaven · com.jamonapi:jamon · fixed in 2.80
- CVE-2013-6429The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entitMaven · org.springframework:spring-web · fixed in 3.2.5.RELEASE
- CVE-2014-1202The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request paramMaven · com.smartbear.soapui:soapui · fixed in 4.6.4
- CVE-2013-2192The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos securMaven · org.apache.hadoop:hadoop-common · fixed in 2.0.6-alpha, 0.23.9
- CVE-2013-4152The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, whMaven · org.springframework:spring-oxm · fixed in 3.2.4.RELEASE
- CVE-2013-7315The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInMaven · org.springframework:spring-oxm · fixed in 3.2.4.RELEASE
- CVE-2013-2185The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1Maven · org.apache.tomcat:tomcat · fixed in 7.0.39
- CVE-2013-4517Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory Maven · org.apache.santuario:xmlsec · fixed in 1.5.6
- CVE-2013-5573Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web scMaven · org.jenkins-ci.main:jenkins-core
- CVE-2013-5676The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by Maven · org.jenkins-ci.plugins:sonar
- CVE-2012-6612The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified iMaven · org.apache.solr:solr-core · fixed in 4.1.0
- CVE-2013-6397Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a ..Maven · org.apache.solr:solr-core · fixed in 4.6.0
- CVE-2013-6407The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an Maven · org.apache.solr:solr-core · fixed in 4.1.0
- CVE-2013-6408The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers Maven · org.apache.solr:solr-core · fixed in 4.3.1
- CVE-2013-6373The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to lMaven · org.jenkins-ci.plugins:exclusion · fixed in 0.9
- CVE-2013-6374Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to Maven · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer · fixed in 1.5.1
- CVE-2013-4204Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allowMaven · com.google.gwt:gwt · fixed in 2.5.1
- CVE-2013-6348Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML Maven · org.apache.struts:struts2-core · fixed in 2.3.16
- CVE-2013-2186The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red HMaven · commons-fileupload:commons-fileupload · fixed in 1.3.1
- CVE-2013-4295The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing aMaven · org.apache.shindig:shindig-php · fixed in 2.5.0-update1
- CVE-2013-4390Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in ApMaven · org.apache.sling:org.apache.sling.auth.core · fixed in 1.1.4
- CVE-2013-2254The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 inMaven · org.apache.sling:org.apache.sling.api · fixed in 2.4.0
- CVE-2013-5823Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earMaven · org.apache.santuario:xmlsec · fixed in 1.4.8, 1.5.3
- CVE-2013-3827Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDevelopeMaven · org.glassfish:javax.faces · fixed in 2.1.19
- CVE-2013-4221The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the JaMaven · org.restlet.jse:org.restlet · fixed in 2.1.4
- CVE-2013-4271The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allowMaven · org.restlet.jse:org.restlet · fixed in 2.1.4
- CVE-2013-4330Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple languaMaven · org.apache.camel:camel-core · fixed in 2.9.7, 2.10.7, 2.11.2 and more
- CVE-2013-4310Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.Maven · org.apache.struts:struts2-core · fixed in 2.3.15.3