Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-4316Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.Maven · org.apache.struts:struts2-core, org.apache.struts:struts2-rest-plugin · fixed in 2.3.15.2
- CVE-2013-4378Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to injMaven · net.bull.javamelody:javamelody-core · fixed in 1.47.0
- CVE-2013-5679The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x beMaven · org.owasp.esapi:esapi · fixed in 2.1.0
- CVE-2013-5960The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x beMaven · org.owasp.esapi:esapi · fixed in 2.1.0.1
- CVE-2013-4112The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive informMaven · org.jgroups:jgroups · fixed in 3.2.9.Final, 3.3.3.Final
- CVE-2013-4766The gather log service in Eucalyptus before 3.3.1 allows remote attackers to read log files via an unspecified request to the (1) Cluster CoMaven · org.jclouds.api:eucalyptus · fixed in 3.3.1
- CVE-2013-2035Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library patMaven · org.fusesource.hawtjni:hawtjni-runtime · fixed in 1.8
- CVE-2013-2172jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5Maven · org.apache.santuario:xmlsec · fixed in 1.4.8, 1.5.5
- CVE-2012-5575Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm Maven · org.apache.cxf:cxf-rt-transports-http · fixed in 2.5.10, 2.6.7, 2.7.4
- CVE-2013-2160The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a deMaven · org.apache.cxf:cxf-rt-frontend-jaxrs · fixed in 2.5.10, 2.6.7, 2.7.4
- CVE-2013-4600Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script orMaven · org.opencms:opencms-core · fixed in 8.5.2
- CVE-2011-1483wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise PorMaven · org.jboss.ws:jbossws-common · fixed in 2.1.0.Final
- CVE-2013-3300The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remoteMaven · net.liftweb:lift-webkit, net.liftweb:lift-webkit_2.7.7 +6 · fixed in 2.5
- CVE-2013-4002XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FMaven · xerces:xercesimpl · fixed in 2.12.0
- CVE-2013-2165ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Maven · org.richfaces:richfaces · fixed in 3.3.3, 4.3.2
- CVE-2013-1879Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary wMaven · org.apache.activemq:activemq-client · fixed in 5.9.0
- CVE-2013-2248Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sitesMaven · org.apache.struts:struts2-core · fixed in 2.3.15.1
- CVE-2013-2251Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,Maven · org.apache.struts:struts2-core · fixed in 2.3.15.1
- CVE-2013-2134Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not Maven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.3.14.3
- CVE-2013-2135Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains bothMaven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.3.14.3
- CVE-2013-1768The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logginMaven · org.apache.openjpa:openjpa · fixed in 1.2.3, 2.2.2
- CVE-2013-1777The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.Maven · org.apache.geronimo.framework:geronimo-jmx-remoting · fixed in 3.0.1
- CVE-2013-1965Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL codeMaven · org.apache.struts:struts2-core · fixed in 2.3.14.3
- CVE-2013-1966Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled whMaven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.3.14.2
- CVE-2013-2115Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled whMaven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.3.14.2
- CVE-2012-3544Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remMaven · org.apache.tomcat:tomcat · fixed in 6.0.37, 7.0.30
- CVE-2013-2067java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and Maven · org.apache.tomcat:tomcat · fixed in 6.0.37, 7.0.33
- CVE-2013-2071java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeExcMaven · org.apache.tomcat:tomcat · fixed in 7.0.40
- CVE-2012-6092Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrMaven · org.apache.activemq:activemq-core · fixed in 5.8.0
- CVE-2012-6551The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial Maven · org.apache.activemq:activemq-web-demo, org.apache.activemq:apache-activemq · fixed in 5.8.0